The board and senior management establish and approve risk-based, enterprise-wide policies that govern outsourcing end to end, from servicing requirements and strategy through provider selection, contract negotiation and monitoring to changing and discontinuing the relationship, proportionate to the institution's size and complexity, ensuring each relationship supports the institution's requirements and strategic plans, that the institution has the expertise to oversee it, that prospective providers are evaluated by the scope and criticality of the service, that the monitoring program is tailored by initial and ongoing risk assessment, that the primary regulator is notified where required, and that time and resources match the risk each relationship presents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.