Risk assessment techniques are applied inside the ISO 31000 process (establishing context, assessing, treating, monitoring, communicating, recording) to improve understanding of uncertainty and support decisions. They are used where more understanding of what risks exist is needed, within a process leading to treatment actions, and when options carrying risk must be compared. Typical aims include supporting decisions, testing assumptions, setting objectives and risk criteria such as appetite and risk-bearing capacity, finding opportunities, identifying effective treatments and showing regulatory requirements are met. How risk is assessed depends on complexity, novelty and knowledge: routine situations follow established rules, very novel or contested ones may call for several techniques with judgement applied, and most techniques fit the middle ground.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.