Risk responses are identified and chosen. For each risk identified, management picks and puts in place a response (accept, avoid, pursue, reduce or share), weighing how severe the risk is and how high it ranks, the business context and the associated business objectives; responses are tailored to industry, geography, regulation and operating structure, what they are expected to cost and deliver is broadly in proportion to how severe the risk is and how it ranks, obligations under regulation or contract are met even where a response is not optimal on cost and benefit, and the response is judged against appetite and tolerance, with the alternative of revisiting strategy and objectives when no acceptable response exists; and the organization considers that a response may introduce new risks or unintended consequences, and that control activities, discussed in the Internal Control framework, give effect to responses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.