Institutions must have a well-documented operational risk assessment and management system integrated into daily risk management, with clear responsibilities, identification of exposures and tracking of relevant data including material losses; an operational risk management function independent of business and operational units; reporting to senior management; regular monitoring and reporting of exposures and losses with corrective action procedures; routines for compliance and policies for non-compliance; regular reviews by knowledgeable internal or external auditors; sound internal validation; and transparent, accessible data flows.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.