Deficiencies in internal control are assessed and passed on promptly to whoever must correct them, and where appropriate to the board and senior management. Points of focus (3). Assessing results: management, and the board where appropriate, weigh what ongoing and separate evaluations have found. Communicating deficiencies: each deficiency reaches the people who must fix it, and goes on to the board and senior management as the case requires. Monitoring corrective action: management follows up to see that remediation happens on time. Approaches the framework suggests for external financial reporting: assessing deficiencies and reporting them; tracking corrective action; setting guidelines for which deficiencies are reported and to whom.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.