IT audit personnel have information systems knowledge commensurate with the scope and sophistication of the IT environment and the analytical skill to find and report root causes; where internal expertise is inadequate the board uses qualified external sources; the institution chooses between a centralised IT audit specialist model and an integrated approach with generalists doing end-user application reviews, uses auditors with technical knowledge appropriate to the area, and keeps hiring, education, experience and continuing training consistent with the responsibilities and the changing technology.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.