The organization communicates with parties outside it about matters that affect how internal control works. Points of focus (5). Outbound communication: processes give shareholders, partners, owners, regulators, customers, analysts and others relevant information when they need it. Inbound communication: open channels allow customers, suppliers, auditors, regulators and analysts to give information to management and the board. Board communication: the board receives the results of assessments made by outside parties. Separate lines: channels such as whistle-blower hotlines are available to outside parties. Choice of method: the method fits the timing, the audience and the nature of what is communicated, and any legal, regulatory or fiduciary requirements. Approaches the framework suggests for external financial reporting: giving outside parties the information relevant to them; gathering information from outside; surveying outside parties; making the whistle-blower programme known outside the organization; reviewing what the external auditor communicates.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.