The insurer must establish and operate within an effective, documented risk management system that includes at least a risk management strategy defining its risk appetite, a risk management policy setting out how all material risks are managed within that appetite, and the ability to respond to changes in its risk profile in a timely way.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.