Risk management is where the claim gets its reason. The decision to select a claim is normally a response to a risk, and the integrity level is a response to its consequence. The clause also makes monitoring of accepted risk an ongoing duty, not a one-off.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.