The auditor judges whether the criteria management relied on were suitable for drafting the description, for evaluating whether the controls are designed well enough to meet the stated control objectives and, in a type 2 report, for evaluating whether they worked effectively across the whole period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.