The governing body should set up an organizational risk framework that makes risk management formal, forward-looking and anticipatory throughout the organization, the governing body included, and embeds it in every activity. The framework should: create the intended risk culture, in which new and emerging risks are reported and each person knows what they are responsible for; steer decision-making behaviour and address how what leaders do, fail to do or overlook affects that behaviour; make risk a central factor when governance policies are set (6.3); take into account the effects of, shifts in and reliance on the context, including stakeholders, trends over short, medium and long horizons (social responsibility and sustainability among them), the purpose, the values, the value generation model and the strategic outcomes; define the governing body's own responsibilities and what it delegates; provide and keep sufficient resources; fix the risk appetite together with risk criteria and limits; and require stakeholders to be engaged responsibly and accurately, bearing in mind the risks, favourable and unfavourable, the organization creates for them (6.6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.