A type 2 report includes a title with the word independent, an addressee, identification of the description, the function and period, the criteria, any uncovered information in the document and any subservice organisation with the carve-out statements (exclusion of the subservice organisation's objectives and controls, dependence on complementary subservice organisation controls, no procedures on them) or the inclusive statement; a statement that the included controls and objectives are those likely relevant to user entities' financial reporting; the statement on complementary user entity controls where the description refers to them; a reference to the assertion and management's responsibilities; the auditor's responsibility and the statement that the examination followed AICPA attestation standards with a description of an examination; the inherent limitations of controls and the risk of projecting to the future; the opinion on the description, the design and the operating effectiveness; a reference to the section describing the tests and results; a restricted-use alert naming user entities, their auditors and the specified parties; the signature, city and state, and the report date.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.