Beyond what its delegates report, the governing body should satisfy itself that the governance system is well designed and working as meant, relying on independent assurance where it cannot check directly. It should: decide how much assurance scrutiny is needed according to the assessed risk; make sure assurance providers have suitable authority and enough resources; make sure they are competent, have the capacity and stay focused; examine the reporting lines of internal assurance providers to protect their independence and authority; examine whether external providers are able to give independent assurance; make sure assurance services are joined up and streamlined so that together they underpin a working internal control system and cover the significant risks and material matters; and show its commitment to assurance while communicating clearly about how its assurance works. Sources that inform it independently include its own direct checks; direct reports from, and private meetings with, the risk and compliance management functions in their role as independent control functions, and from internal audit in its role as independent assurance provider on governance processes and internal control; external audit; and whistleblowing and feedback channels (ISO 37002). Where external auditors are used, the audit firm or the auditors should be rotated, and any non-audit work should be weighed carefully and disclosed openly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.