The institution regularly reviews risk events to identify systemic problems, determines mitigation strategies and reports the results to management for approval and action, so that repeated risk events do not become normalised and slow the response to a real incident, as happens when repeated false intrusion alerts are ignored. Beyond technical causes it looks for underlying issues such as staff non-compliance with frameworks and processes, poorly designed processes, and service requests from users left unresolved or ignored.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.