Senior management involves IT audit in major application development, acquisition, conversion and testing: the auditor reviews the internal controls, testing and audit trails at each stage of the development life cycle, guidelines let controls be identified during design, and the board-approved audit policy sets out what involvement internal audit has, the monitoring, reporting and escalation processes where controls or testing are inadequate, and the life cycle phases for acquisitions, with audit participation early in due diligence for acquisitions with significant IT impact, all while audit stays independent and objective and never takes management decisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.