With the board overseeing, management sets up structures, reporting lines, and suitable authorities and responsibilities for pursuing objectives. Points of focus (3). All structures: management and the board take into account every structure through which objectives are pursued, including operating units, legal entities, geographic spread and outsourced service providers. Reporting lines: management designs and reviews reporting lines so that authority and responsibility can be exercised and information flows for managing activities. Authorities and responsibilities: through suitable processes and technology, authority is delegated, responsibilities are defined and duties are separated at each level: the board retains significant decisions and reviews what management delegates, senior management sets directives and guidance, management puts them into effect in the units, personnel understand the conduct standards, risks, controls, information flows and monitoring relevant to their level, and outsourced providers work within the scope management sets. Approaches the framework suggests for external financial reporting: setting roles and reporting lines and checking they remain relevant; setting authority for each level of management; keeping job descriptions and service-level agreements current; setting out what internal auditors do.
This control maps to 4 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.