Guidance: those managing the programme should identify the risks and opportunities associated with it and put them before the audit client so that they can be dealt with. Risks can arise in planning (irrelevant objectives, wrong extent or schedule), resources (insufficient time, equipment or training), audit team selection (insufficient competence), communication, implementation (poor coordination, information security ignored), control of documented information (audit records inadequately determined or protected), monitoring and review, and whether the auditee is available and cooperative and whether evidence can be sampled. Opportunities include combining audits in one visit, minimising travel, matching team competence to need and aligning dates with key staff availability.
This control maps to 12 controls across 11 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 12 it maps to, and the evidence behind each claim, over MCP and REST.