Impact areas (reputation, financial health, regulatory compliance and the like) are identified and prioritised, risk tolerance parameters are set for each, and tolerance thresholds that trigger action are defined for each risk category.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.