The institution must have a designated risk management function that assists the Board, board committees and senior management to maintain the framework, is proportionate to size, business mix and complexity, is operationally independent, has the authority and reporting lines to act effectively and independently, is staffed with people of appropriate experience and qualifications holding clearly defined roles, has access to every part of the institution capable of generating material risk including information technology systems and systems development resources, and is required to notify the Board of any significant breach of or material deviation from the framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.