Scaled from a single champion to a full department, the function sets risk policy and strategy; champions risk management at both strategic and operational levels; builds a risk-aware culture with education; sets the internal risk policy and structures used by business units; designs and reviews risk processes; coordinates the functions that advise on risk; develops response processes, contingency planning and business continuity programmes among them; and prepares risk reports for the board and stakeholders.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.