The board of an institution that outsources its internal IT audit function ensures the structure, scope and management of the arrangement provide an adequate evaluation of the internal control system, that there are no conflicts of interest and that independence is not compromised by an audit firm that also provides financial statement audit or IT or management consulting, and remains responsible for the effectiveness of the outsourced function and its compliance with the interagency policy statement on the internal audit function and its outsourcing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.