The board and senior management engage internal audit or independent, qualified personnel to review and validate the design and operating effectiveness of the BCM program, with a scope and frequency set by the entity's complexity, risk profile and change; audit reports to the board with an assessment of management's ability to oversee continuity and resilience risk, evaluates the BIA and risk assessment for reasonableness and the controls for reliability, adequacy and effectiveness, leverages third-party providers' SOC and other external reports, and the board reviews the reports and tracks findings to resolution.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.