Requirement
The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
Points of Focus
Establishes Oversight Responsibilities
Requirement: The board of directors identifies and accepts its oversight responsibilities in relation to established requirements and expectations.
Applies Relevant Expertise
Requirement: The board of directors defines, maintains, and periodically evaluates the skills and expertise needed among its members to enable them to ask probing questions of senior management and take commensurate action.
Operates Independently
Requirement: The board of directors has sufficient members who are independent from management and objective in evaluations and decision making.
Supplements Board Expertise
Requirement: The board of directors supplements its expertise relevant to security, availability, processing integrity, confidentiality, and privacy, as needed, through the use of a subcommittee or consultants.
Explanation
The board of directors, or an equivalent oversight body, must be sufficiently independent from day-to-day management and skilled enough to challenge it, actively supervising how internal control is designed and performing. Auditors care because independent oversight is the main check against management overriding or neglecting controls.
