When planning the management system, the organization must take account of the requirements under 4.2 and the issues under 4.1 and 4.5, and identify the risks and opportunities it must deal with so as to: be confident the system can deliver what it is meant to; prepare action and business plans; predict economic, environmental and social effects over short, medium and long horizons; avoid or lessen unwanted effects; allocate natural, human and financial resources; assign who implements, supervises and evaluates; set a timetable for implementation; and keep improving. It must plan how to respond to those risks and opportunities, how to build medium- and long-range projections backed by matching financial provision, how to encourage financial innovation that reduces risk, how to build the responses into the system's processes, and how to judge whether they worked; where applicable, the plans for risks and opportunities must be documented and reviewed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.