The institution defines quantitative and qualitative metrics for the effectiveness of its risk controls, using common metrics across risk sources supplemented by source-specific ones, and taking into account risk events that occurred or were averted, auditor and regulator observations and regulatory requirements. Systems and processes collect the metrics accurately and in time and are themselves reviewed; the metrics are reviewed regularly to judge whether controls prevent or reduce risk, and controls are updated for deficiencies with regard to their severity and the impact on other controls and risk sources. Where a control repeatedly misses its metric, its design is reviewed for root cause and alternative controls or processes are put in place.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.