I am wrapping up an approval on an internal audit report, and I noticed that the auditor team had the following:
Requirement: The organization shall determine the controls to be applied to externally provided processes, products, and services when a process, or part of a process, is provided by an external provider as a result of a decision by the organization.
Method: This seems to refer to COMPANY deciding to discontinue a process and have a outside vendor take it over.
Evidence: While we outsource painting for example and a few other activities, we haven’t done a procedure in house and then outsourced it according to interview.
I questioned if this is a rather narrow interpretation or audit of this requirement. The response was basically "That just what we thought it meant." So I am just curious is people have examples or ways to help me flush out or differentiate these sections (a-c).