IT audit reports go to management and directly to the board or its committee, the board oversees the IT auditors' performance, compensation, expertise and the adequacy, timeliness and independence of coverage, an outsourced IT audit is engaged by the board or audit committee, IT auditors validate that controls are designed to mitigate risk and operate as intended without designing or implementing controls or enforcing policy, verify that management's compliance monitoring works and report to the board, and senior management ensures cooperation with IT audit and timely, accurate corrective action on audit concerns.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.