An information system audit of internal systems and processes must be in place and conducted at least once every two years by CISA-certified external auditors; the report goes to the Regional Office of the Department of Supervision with jurisdiction over the registered office within one month of the auditor submitting it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.