The board and senior management engage internal audit or other independent, qualified personnel or third parties to review AIO functions and validate the design, implementation and operational effectiveness of controls, with auditors independent of the functions reviewed and trained in the technologies in use such as cloud, a scope and frequency set by complexity, risk profile and change, results reported to the board, third-party providers' AIO audit and review reports evaluated, and independent certifications such as SOC reports used appropriately.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.