Risk to the programme is removed or reduced by a systematic process that plans for, finds, analyses, responds to, monitors and controls the areas and events that could cause unwanted change: a formal approach to risk, consistent with the enterprise's ERM framework, covers identification, analysis, response, mitigation, monitoring and control; skilled people are made responsible for carrying out the enterprise risk process inside the programme and building it into solution development; risk is identified and quantified on an ongoing basis across the programme and is managed and communicated through the programme's governance structure; and each action to avoid, accept or reduce a risk has an identified owner.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.