Finding risks brings uncertainty out into the open, and depending on context and scope can span every origin of uncertainty and effects that help as well as harm. It uses the knowledge of varied stakeholders and considers what uncertainty and effects exist, which circumstances could have future consequences, which risk sources exist or may develop, what controls exist and whether they work, the what, how, when, where and why of events, relevant history and human and organisational aspects. Physical surveys may help. Outputs may be a risk list with events, causes and consequences. Identification is methodical and iterative and early enough to allow action, and a mechanism captures emerging risks and early warning signs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.