The governing body sets direction, delegates responsibility and resources, and receives management reports on outcomes and risk, with strong two-way communication between them. Internal audit stays independent and accountable to the governing body yet interacts regularly with management so its work fits strategic and operational needs without duplication, overlap or gaps. The governing body oversees internal audit by appointing and removing the chief audit executive, providing a primary reporting line, approving and resourcing the plan, receiving reports, and allowing private access without management present; all roles should coordinate, collaborate and communicate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.