Beyond ISO 31000:2018, 6.3.4, legal risk criteria are a subset of organizational risk criteria: measures set to judge what level of a single legal risk, or a set of them, is significant and what is acceptable, mirroring the values, objectives, preferences, resources and tolerance behind risk management as a whole, reviewed regularly and at the start of any major project, derived from law or contractual obligations, dynamic, owned by the legal risk function and aligned with the organization's legal risk approach or policy, adjusted to real situations. Factors: objectives and priorities; governance, meaning who ranks above whom and how roles and accountabilities are assigned; third-party relationships; the scope, objectives and categories of legal risk; the principles for determining risk level; the status of policies, frameworks, processes and methods; stakeholders' acceptance or tolerance; and the measurements for classifying levels. Situations requiring the criteria include what law requires the organization to do or approve, policies or contracts it must adopt or decisions only it can lawfully make, substantial institutional liability or compliance matters (government investigations, widespread violations, criminal conduct, major non-compliance, data loss, whistle-blower complaints, reputational loss, lawsuits), disclosure laws, and lawsuits and settlements outside the normal course of business. Criteria should be agreed at management level and throughout the organization; unduly narrow or restrictive criteria isolate legal risk owners in a silo and bring the legal function in only when a crisis escalates rather than early when treatment is easier.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.