The bank has a separate IS audit function or skilled resources within internal audit; where external resources fill skill gaps, responsibility and accountability stay with the competent authority in internal audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.