Internal audit, which in addition to Appendix A should ensure the framework complies with the Guidelines and suits the bank's size, complexity and risk profile, should identify and communicate to the audit committee significant instances where front line units or IRM are not adhering to the framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.