Management defines a risk assessment methodology that gives the auditor and the board objective information for allocating audit resources; the risk-based IT audit program identifies the institution's data, applications, operating systems, technology, facilities and personnel and the business activities within each, profiles significant business units and systems with their risks and controls, scores business and control risks, has the board or audit committee approve the risk assessments and the annual risk-based audit plan with its schedules, cycles, scope and resources, implements the plan through planning, execution, reporting and follow-up, and monitors and updates the risk assessment at least annually for every significant unit, product or system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.