The board establishes an effective risk-based audit function that covers all of the institution's major activities, with the frequency and depth of each area's audit set by that area's risk assessment and appropriate to the institution's size and complexity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.