An organization is modernizing its technology policy framework to demonstrate compliance with external industry standards. Which of the following would be MOST useful to an IS auditor for validating t

To validate compliance with external industry standards, an IS auditor needs a clear demonstration that the organization's internal controls directly address and satisfy the requirements of those standards. A mapping document provides this direct linkage, showing exactly which control fulfills which standard requirement, enabling efficient and thorough validation.

An inventory of policy exceptions shows where the organization is *not* compliant or has accepted risks, which is informative but does not directly validate the effectiveness of the overall framework for demonstrating compliance.

Policy recommendations from an external agency are inputs for developing the framework, not direct evidence for validating the *outcome* of compliance with specific standards.

Benchmarking against peer organizations provides context on industry practices but does not directly prove an organization's compliance with *specific* external industry standards; it's a comparative tool, not a compliance validation tool.