The governing body should oversee performance, judging and correcting as needed on the basis of: whether the values and governance policies genuinely steer how the organization works, its culture and how ethically it behaves; management reports and performance measured against the relevant criteria and against its expectations; risk information, including reports straight from the risk function, on the main threats and opportunities under the risk framework (6.9); compliance information, including reports straight from the compliance function, on compliance culture and obligations; how stakeholders are identified and engaged (6.6); financial results and resources, so the organization stays financially sound; how resources are allocated, and the organization's capacity and capabilities, people and their development included; how data is controlled and processed as a strategic resource (6.8); responsible and ethical use of technology, including artificial intelligence and cyber security, and sufficient investment in it; and how plans, organizational change and transformation, and responses to unexpected events and incidents are managed (ISO 31000, IEC 31010, ISO 37301, ISO/IEC 38500 and ISO/IEC 38507 are the referenced sources).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.