This process group covers the enterprise-wide risk programme, from agreeing how much risk the organisation will accept and writing the supporting policies, through to choosing tools and circulating risk information between functions. It takes in surfacing risks that affect the whole organisation, judging which ones to treat, and building a mitigation approach that connects to existing performance management. It also covers confirming that business units and functions carry out their agreed mitigation plans, keeping risks and actions under review, and reporting progress to senior leaders and the board. At business unit level it spans local risk identification, assessment against the central framework, mitigation planning that weighs whether insurance cover is sufficient, implementation, monitoring, and periodic refresh of plans and reports.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.