The organization chooses, designs and carries out ongoing evaluations, separate evaluations or both, to establish whether each component of internal control is in place and working. Points of focus (7). Mix of evaluations: management weighs how much to rely on ongoing versus separate evaluations. Rate of change: how fast the business and its processes change affects which evaluations are chosen. Baseline: the design and present state of the system give the starting point for evaluation. Knowledgeable evaluators: the people evaluating understand what they are looking at. Integration: ongoing evaluations sit inside business processes and adapt as conditions change. Scope and frequency: separate evaluations are scoped and scheduled according to risk. Objectivity: separate evaluations are carried out from time to time to provide objective feedback. Approaches the framework suggests for external financial reporting: revisiting the balance of monitoring activities periodically; setting a baseline; defining and using metrics; building and using a dashboard; supporting monitoring with technology; performing separate evaluations; having internal audit perform separate evaluations; understanding the controls operated by an outsourced service provider.
This control maps to 4 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.