Input: approved plans and acceptance criteria. Action: decide whether residual risks are acceptable. Trigger: the organisation must decide on retaining residual risk. Output: accepted residual risks. Plans feed a later reassessment of the likelihood and consequence that remain, weighing how the proposed controls and their effectiveness reduce likelihood, consequence or both, and the owner judges the resulting level; plans describe how assessed risks will meet the criteria. Where criteria do not fit prevailing circumstances (a valuable business opportunity, or modification costing too much) and cannot be revised in time, owners may retain risks outside normal criteria, explicitly commenting and justifying the override. Acceptance may follow a chain of endorsements; owners review and approve plans and resulting residual risk and record any conditions, and some cases need a manager above the owner to agree. Criteria may let risk exceed the threshold to a defined extent while a plan reduces it within an acceptable time, taking account of plan timeframes and actual progress, and may set thresholds according to how long the organisation is exposed to a risk that varies over time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.