Management's job of achieving objectives covers both first and second line roles: first line roles deliver products and services to clients, while second line roles support risk management with expertise, monitoring and challenge. The two may be combined or kept separate, and second line work can range from specific risk topics to enterprise-wide risk management, but first line management always keeps ownership of risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.