It doesn't mandate it explicitly, but your auditor may get fussy if you can't answer questions about the relevant controls with a clear answer.
It doesn't mandate it explicitly, but your auditor may get fussy if you can't answer questions about the relevant controls with a clear answer.