The board keeps the audit function out of activities that would compromise or appear to compromise its independence, gives the auditor authority to access all records and staff and to require timely formal management responses to significant adverse findings, has internal auditors discuss findings with the audit committee or board periodically, has the internal audit manager report to the board or audit committee (a dual reporting line to executive management for administrative matters is acceptable if it runs to the CEO and not to an officer responsible for the audited systems), and determines the audit manager's evaluation and compensation itself.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.