The controller must carry out, or have carried out, the audits needed in its own institution or organisation to ensure the implementation of the Law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.