The bank keeps enough controls and procedures to spot and size threats, weak points and operational risk generally while there is still time to stop them reaching critical operations. The three lines check regularly that those controls work, repeat the check whenever a component underlying a critical operation changes, and repeat it again after an incident so that what was learned, and the new threat or weakness that caused the incident, are built in.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.