Each level needs different information. The board should know the most significant risks, the possible effect on shareholder value of results outside expected ranges, how a crisis would be handled, the importance of stakeholder confidence and how to communicate with investors; ensure awareness across the organisation; be assured the process works; and publish a plain risk management policy setting out its philosophy and who is responsible for what. Business units should know the risks in their area and their knock-on effects, have indicators to monitor key activities and progress and spot developments needing action, communicate budget and forecast variances in time to act, and report new risks or control failures promptly. Individuals should know which risks they answer for and how to help improve risk response, treat risk awareness as part of the culture, and report new risks or failed controls promptly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.