Risk assessment means analysing and evaluating the identified risks, both to the project's processes and to what it delivers. Every identified risk should be assessed, drawing on experience and historical data from earlier projects. The assessment's criteria and techniques should themselves be evaluated; qualitative analysis comes first, with quantitative analysis after it wherever possible (methods generally rest on the probability and impact of the risks). The levels of risk acceptable to the project, and how to tell when agreed levels have been passed, should be identified. The results of every analysis and evaluation should be recorded and passed to the relevant staff.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.