The governing body should make sure it takes into account how uncertainty bears on the organization's purpose and the strategic outcomes tied to it. Value comes from taking suitable risk at the right time, and that happens when the governing body strikes the right balance: making unacceptable outcomes less likely and less damaging while allowing the organization to take suitable risks on purpose and grasp opportunities. It should take accountability for the organization continually detecting and reacting to risk, explain the chosen approach to stakeholders, set the tone for risk management, assess, treat, monitor and communicate the risks involved whenever it decides, and oversee the organization's risk management (ISO 31000 and IEC 31010 are the referenced sources).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.