The auditor or firm also keeps policies on how audits are performed, how staff are coached, supervised and reviewed, and how the audit file is organised; an internal quality control system covering at least those policies, with responsibility in a firm resting on a qualified statutory auditor; systems, resources and procedures ensuring continuity and regularity of audit activities; arrangements for dealing with and recording incidents with serious consequences for the integrity of audit activities; remuneration and profit-sharing policies that give sufficient incentives for audit quality and that exclude revenue from non-audit services to an audited entity from the performance evaluation and pay of anyone involved in or able to influence that audit; and monitoring and evaluation of the adequacy of these systems, with an annual evaluation of the internal quality control system, records of findings and proposed changes, and corrective measures. The policies are documented and communicated to employees.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.