Quality risk management is based on ICH Q9 and applied to computerized systems so that the evaluation of risk is grounded in scientific knowledge of the process and the system and tied in the end to protecting the patient, and the effort, formality and documentation spent match how great the risk is. Risk is considered in terms of severity of harm, probability of occurrence and probability of detection; system impact, complexity and novelty and the supplier assessment inform the approach; and the process is used to scale life cycle activities, to focus effort on high-risk functions and to select and verify controls, with existing risk assessment methods and tools used where the organization already has them.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.