Risk Assessment Process. The programme must include a risk assessment process; assessments must be documented and retained for at least five years, and the control environment continuously monitored and evaluated (paras 20-22).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.