The compliance function shall be responsible for the operation of the CMS: promoting identification of compliance obligations; documenting the compliance risk assessment (4.6); aligning the CMS with the compliance objectives; monitoring and measuring compliance performance; analysing and evaluating CMS performance to identify the need for corrective action; establishing compliance reporting and documentation systems; ensuring the CMS is reviewed at planned intervals (9.2, 9.3); and establishing a system for raising concerns and ensuring they are resolved. It shall oversee that responsibility for meeting identified obligations is appropriately assigned across the organization, that obligations are integrated into policies, processes and procedures, that all relevant personnel are trained as required, and that compliance performance indicators are established; it shall provide personnel with access to resources on the compliance policy, processes and procedures and advise the organization on compliance matters, without relieving others of their compliance responsibility. The organization shall ensure the compliance function has access to senior decision makers with the opportunity to advise early in decision making, to all levels of the organization, to all personnel, documented information and data it needs, and to expert advice on relevant laws, regulations, codes and organizational standards.
This control maps to 8 controls across 7 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 8 it maps to, and the evidence behind each claim, over MCP and REST.