Identification locates, recognises and describes the legal risks that could support or hinder the objectives: where legal risk comes from, the areas it affects, events (changed circumstances included) with what causes them and what they could lead to, described comprehensively, systematically and accurately with the latest information (changes in law, market practice), whether or not the sources are within the organization's control or the causes known, using tools suited to objectives, resources and environment (IEC 31010). The organization should systematically identify legal risks and their implications for activities, products, services and reputation, document them proportionately to its size and operations, and may identify risks relating to objectives and priorities; governance and ethics structures and operations (sales, service delivery, production, marketing, procurement, foreign investment, HR, finance, structure, reputation, information and data, ICT); cyber threats of every kind, social engineering and cyber-attack included; interested parties; misapplication of the legal context, non-compliance, breach of contract, IP infringement, misconduct and failure to exercise rights; the criminal, administrative, civil and regulatory liabilities after occurrence; specific laws, conflict of laws and private international law; and case and common law, remembering that legal reaches beyond the home jurisdiction to international obligations. Useful information includes the laws, the external and internal context, stakeholder communication, existing criteria and plans, privilege and work-product record-keeping rules and data retention policies; relevant compliance obligations include agreements with communities, authorities and customers, organizational policies and ethics, voluntary codes, labelling and environmental commitments, contractual obligations and standards. The organization should set a method for identifying legal risk that offers several approaches and enabling every level to identify and report, and should have processes for spotting laws and obligations that are new or have changed and evaluate their consequences, for instance through regulator mailing lists, professional groups, information services, forums, regulator websites and meetings, litigation trend monitoring, legal advisers, law firm publications, internal audit insight, an internal legal risk knowledge database and monitoring of obligation sources. Annex A gives an identification matrix, Annex B a register, Annex E key contract clauses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.