How severe each risk is gets assessed. Every risk in the inventory is assessed for its severity to the strategy and business objectives, at the levels of the entity at which it applies (a risk may retain, increase or decrease in severity as it is viewed at higher levels); management selects severity measures aligned to the entity's size, nature, complexity and risk appetite, typically likelihood and impact with persistence, velocity and complexity where useful, using qualitative approaches (interviews, workshops, surveys, benchmarking) where quantification is impracticable and quantitative ones (probabilistic and non-probabilistic modelling, scenario analysis, stress testing) where data allow, considering interdependencies; a distinction is drawn between inherent risk, the residual risk being aimed at, and the residual risk actually present; results are depicted in heat maps or risk profiles against the appetite; triggers for reassessment such as changes in context or appetite are identified; and bias in assessment is identified and mitigated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.