Risks should be identified at project start, at progress evaluations and whenever significant decisions are taken, using experience and historical data the originating organization holds from earlier projects (8.3.1). The results should go into a risk management plan that forms part of, or is cited in, the project management plan. Possible risks from interactions (in activities, processes and products or services) linking the project organization with the originating organization and with stakeholders should be identified and recorded. Identification should look beyond cost, time and product or service to areas such as product or service quality, security, dependability, professional liability, IT, safety, health and environment, and possible changes in legal and regulatory requirements, and should consider how different risks interact and the risks brought by new technologies and developments. Watching for opportunities while identifying risks is recommended, since opportunities and the actions they prompt can bring real benefits in cost, quality, timeliness and the image of the project or service. Every identified risk whose impact is significant should be documented, with a person given the responsibility, authority and resources to manage it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.