The bank can capture and aggregate all material risk data across the group, available by business line, legal entity, asset type, industry, region and other groupings relevant to the risk, so that exposures, concentrations and emerging risks can be identified and reported. Capabilities include all material exposures, including off-balance sheet. Risks need not share one metric, but capabilities are the same whatever aggregation system is chosen and each system states the approach it uses so the board and senior management can assess results. Supervisors expect aggregated data to be materially complete, completeness to be measured and monitored, and any exception identified and explained. The materiality concept allows information to be left out only if it would not change a decision; it looks beyond size to risk type and business dynamics and future impact, and the bank must be able to explain omissions.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.