Management develops an IT risk reporting process that assembles and reports IT risk information in a timely, complete, transparent and decision-relevant way, with periodic risk-based reports to senior management, the board and stakeholders who have the authority and responsibility to act, can provide credible challenge and are accountable for outcomes, defined under the enterprise-wide risk management program and triggering appropriate, timely and reliable escalation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.