Auditors should have the knowledge and skills needed so that the audits they are expected to carry out achieve what is intended. This means generic competence combined with knowledge and skills particular to the discipline and sector, and, for team leaders, further competence to lead. Generic knowledge and skills cover: (a) audit principles, processes and methods, namely understanding audit risks and the risk-based approach; planning and organising the work; keeping to the schedule; setting priorities; communicating orally and in writing, including through interpreters; gathering information through interviews, listening, observation and review of documented information such as records and data; understanding how sampling is used and what follows from it; understanding the opinions of technical experts; auditing a process from start to finish together with its links to other processes; understanding whether ICT tools and emerging technology, AI-based evaluation tools for example, are appropriate and what their use implies; checking relevance and accuracy; confirming that evidence is sufficient and appropriate; weighing the factors that affect reliability; documenting the audit work and writing reports; preserving confidentiality and information security; and achieving the intended results; (b) the management system standards and other reference documents, how they apply and interact, and their priorities; (c) the organization and its context, including interested parties, governance, structure, general business concepts, and cultural and social aspects; and (d) statutory, regulatory and other applicable requirements, including the agencies involved, basic legal terms, contracts and liability, and data protection and information security, without implying that auditors must be legal experts. Across the team there should be enough competence particular to the discipline and sector, covering: the requirements and principles and how they apply; the fundamentals of the discipline and sector; the methods, techniques, processes and practices of the discipline and sector; and the principles and techniques for assessing risks and opportunities linked to the objectives. A team leader should be able to: plan the audit and hand out tasks according to competence; discuss strategic matters with top management; keep the team working together well; manage the audit process, including resources, uncertainty, the team's health, safety and security, the direction of auditors and auditors-in-training, and the resolution of conflicts; represent the team; lead it to its conclusions; and prepare and finish the report. Auditors working across several disciplines should understand how the systems interact and reinforce each other, and team leaders should know where their own competence in each discipline ends.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.