Guidance: risk management exists to create and protect value, and the eight principles describe what makes it effective; they should shape the framework and the process and let the organization manage the effect of uncertainty on its objectives. Integrated: managing risk is part of every activity, not a separate function. Structured and comprehensive: a systematic approach gives results that can be compared. Customized: the framework and process are proportionate to the organization's context and objectives. Inclusive: stakeholders are involved early enough for their knowledge and perceptions to count. Dynamic: risks appear, change and disappear as the context moves, and the organization anticipates and responds in time. Best available information: inputs draw on past and present data and on expectations of the future, with their limits stated, and information reaches the people who need it when they need it. Human and cultural factors: behaviour and culture shape every stage. Continual improvement: risk management gets better through learning and experience.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.