All information and documents the auditor accesses in a statutory audit sit under adequate confidentiality and professional secrecy rules, which never block enforcement of the Directive or Regulation (EU) No 537/2014 and which continue to bind an auditor who has ceased the engagement. When replaced, the former auditor gives the incoming auditor access to all relevant information about the audited entity and its most recent audit. The secrecy rules do not prevent transfer of audit documentation to a third-country group auditor where needed for the group audit, subject to data protection law, while transfers to third-country competent authorities may be made only under Article 47.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.