Risk is taken into account when business objectives are set at the various levels, and those objectives line up with and support the strategy. Objectives are specific, attainable, relevant, and measurable or at least observable, aligned with strategy wherever they sit, understood for the implications of each choice, and categorized as the entity finds useful; performance measures and targets are set to monitor achievement; and tolerance, the acceptable variation in performance around a target within the risk appetite, is defined for each objective so that exceeding and trailing variation can be judged, remembering that exceeding a target is not always a benefit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.