Advanced control principles for audit (required, with baseline and intermediate, of an AI whose inherent risk is high). Audit regularly compares the cyber risk appetite statement with assessment results and reviews the gaps found; audits or reviews identify control weaknesses, their root causes and their potential impact on business units; a formal process updates audit procedures for changes in the threat landscape of other sectors the institution depends on.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.