Whatever the form of outsourcing, from assistance on a single assignment to performance of most of the internal audit work, the institution keeps an internal audit manager and staff sufficient to oversee the provider, has the provider report significant findings jointly with the audit manager to the board or audit committee, performs due diligence on the provider's qualified staff before contracting and monitors its continuing expertise and key staffing changes, and holds a contingency plan for the sudden termination of the arrangement, with the contract setting out the scope, responsibilities, access, reporting and other terms the guidance lists.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.