Operating management responds formally and effectively to IT audit and examination findings, correcting root causes rather than symptoms within reasonable times set by the complexity of the fix and the risk of inaction, while auditors document, report and track recommendations and outstanding deficiencies and follow up in time to verify that corrective action for significant deficiencies worked.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.