A view of risk across the whole portfolio is built and then evaluated. Management first considers risk by division, unit or function and then across the entity, so that interdependencies, concentrations and offsets appear; the portfolio view can be built from risk categories with metrics such as capital at risk, or with increasing integration through a risk profile view organized by business objectives and dependencies, up to a full portfolio view against strategy, and the same risk can gain or lose severity as it aggregates; the view is analysed with qualitative and quantitative techniques, including regression and sensitivity analysis and stress testing, to understand how the risk curve responds to shocks against the risk appetite, and to identify when the aggregated risk approaches or exceeds appetite.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.