This process group covers the compliance programme as a whole: the policy and procedure set, the internal audit and control technology that support it, and the handling of regulatory obligations. It spans drafting regulatory procedures, working out which requirements apply to the organisation, watching for new or changing rules, and assessing where the current position falls short. It continues through closing those gaps with stronger controls and policies, testing and monitoring what is in place, and producing scorecards and reports for internal and external audiences. It also includes maintaining appropriate contact with regulators.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.