The board sets strategic direction and creates the environment and structures for risk management to work, possibly through an executive group, non-executive or audit committee or other sponsor. In evaluating internal control it should at least consider the nature and extent of acceptable downside risks, their likelihood, how unacceptable risks are managed, the ability to reduce probability and impact, the costs and benefits of risk and control activity, the effectiveness of the process and the risk implications of its own decisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.