ISO 31000:2018 6.3.3 applies, plus: features of the organization itself can be risk sources whose consequences hit the organization while no individual is harmed; the standard's example is a senior leader's public statement on privacy that shapes how the organization is seen.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.