Project risk is removed or reduced through a systematic approach that plans for, identifies, analyses, responds to, monitors and controls the areas or events that could bring about unwanted change: a formal approach to project risk, consistent with the enterprise risk management framework, covers identification, analysis, response, mitigation, monitoring and control; skilled staff are made responsible for carrying it out within the project and for building it into solution development; owners are named for the actions that avoid, accept or mitigate each risk; risk is identified and quantified on an ongoing basis and is managed and communicated within the project governance structure; risk is reassessed from time to time, including when each major phase begins and when major change requests are assessed; and a register holding every potential project risk and a log of all issues and their resolution are kept and reviewed, with the log analysed for trends and repeating problems.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.