When reviewing how the entity has performed, the organization takes risk into account. Reviews of performance against targets and tolerances are integrated into business practices, asking whether the entity is performing as expected, what risks are occurring that may affect performance, whether the entity was taking sufficient risk to attain its targets and whether the risk estimates were accurate; where performance falls outside acceptable variation or the target implies a different risk profile than expected, the organization may review the business objectives, the strategy, the tolerance, the risk responses or the enterprise risk management practices themselves, and it considers its capabilities and their effect on performance; monitoring activities are discussed in the Internal Control framework.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.