The organization plans and runs one or more audit programmes covering frequency, methods, responsibilities, planning and reporting, giving weight to the importance of the processes and earlier results. For each audit it defines objectives, criteria and scope, picks auditors and runs audits so they are objective and impartial, reports results to relevant managers, reports relevant results to workers, their representatives and other interested parties, and acts on nonconformities and to improve performance. Evidence of the programme and results is kept. ISO 19011 is cited for guidance.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.