The board and management ensure the risk scoring system is understandable, covers all relevant risk factors (adequacy of internal controls, nature and volume of transactions, system age, operating environment, physical and logical security, management oversight, prior regulatory and audit results and management's responsiveness, human resources and senior management oversight) and avoids subjectivity; auditors write guidelines on the use of the risk assessment tools and factors, review them with the audit committee or board, grade the major risk areas on a defined scale, and specify in the guidelines the maximum audit cycle for each risk score and the timing, scope and documentation rules that follow.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.