The governing body should weigh and manage the risk arising from its own activities within the organization's risk framework. It should: make sure it is told, fully and early, about new and emerging risk; when weighing strategic options, look at threats and opportunities alike and at how far each option advances the purpose and values, including its effect on the environmental, social and economic context (6.11.3); when choosing a strategy, weigh it against the shifting risk context and make sure the resulting risk is treated and monitored; disclose significant risk, limits and expectations to stakeholders as part of accountability (6.5.3); and explain to stakeholders what risk has been accepted and how much, giving assurance that the organization will stay within the set limits and correct course when needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.