Criteria for how much risk is acceptable in pursuit of objectives (often called risk appetite) are defined by specifying a technique or parameter that gauges magnitude with a limit beyond which risk is unacceptable, or by acceptable variation in performance measures. Limits can depend on potential reward and differ by consequence type, for example financial versus human life. Examples of considerations are risk-bearing capacity tested with stress scenarios, ALARP, ALARA or SFAIRP duties in some jurisdictions, the globally-at-least-equivalent principle and cost/benefit measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.