The risk appetite statement must articulate at least the degree of risk the RSE licensee will accept in pursuit of its strategic objectives and business plan having regard to the interests of beneficiaries, for each material risk the maximum level it is willing to operate within expressed where possible as a measurable residual risk limit after allowing for mitigants, the process for setting risk tolerances at an appropriate level based on estimated impact on beneficiaries of a breach and the likelihood of the risk being realised, the process for monitoring compliance with each tolerance and acting on a breach, and the timing and process for reviewing appetite and tolerances.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.