For each risk category institutions must disclose strategies and processes, the structure and authority of the risk management function, the scope of risk reporting and measurement, hedging and mitigation policies and their monitoring, a management body declaration on the adequacy of risk management arrangements, and a concise management-body-approved risk statement with key ratios showing how the risk profile relates to the risk tolerance; and governance information including the number of directorships of board members, the recruitment and diversity policy, the risk committee and the information flow to the management body.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.