The regulated company may count supplier work, testing included, towards verification as long as the supplier's processes have been assessed as suitable, which, according to risk, novelty and complexity, may involve an audit; the review looks for an acceptable quality system, technical capability and application of good practice such that supplier information is complete, accurate and suitable, and supplier documentation is assessed for content and quality with regulated company procedures flexible about format and structure. Where inadequacies are found the company may apply targeted additional verification rather than repeating supplier activities, the decision and justification to rely on supplier activities are documented and approved by subject matter experts including the quality unit for matters critical to patients, product quality and the integrity of data, and supplier tools and techniques may also be leveraged.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.