The governing body validates the risk map before it is applied and at each update, after presenting it to the non-executive body where there is one; the need to update is assessed every year and whenever the business changes notably. The map is formalised as written documentation with an annex describing the method, and the company keeps the records of staff exchanges, the gross and net scoring methods and definitions, identification and classification procedures, every version presented with its validation and action plan, and committee minutes, dated, referenced and archived (paragraphs 32, 127 and 151 to 155).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.