The institution must designate a person as Chief Risk Officer responsible for the risk management function, who must be involved in and have authority to effectively challenge activities and decisions that could materially affect the institution risk profile.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.