Reporting on risk, on culture and on performance happens throughout the entity and at several levels. Report users and their roles are identified (board, executives, operating management, risk owners, regulators) with the level of detail each needs; reporting combines quantitative and qualitative information, is forward-looking as well as historical, and connects strategy, business objectives, risk and performance; types include the portfolio view, the risk profile, analysis of root causes, sensitivity analysis, new and emerging risks, key risk indicators, trend analysis, disclosures of incidents and losses, and plans and initiatives, supplemented by subject-matter commentary; the board receives the most senior tier of reporting, which contains the portfolio view; culture is reported through analytics of cultural trends, lessons learned, surveys and behavioral indicators; key indicators, quantitative or qualitative, predict a risk manifesting; and management agrees frequency, content and presentation with users and implements controls so that reports are accurate, clear and complete.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.