Makes sure the organization grasps its risks and deals with them effectively, covering both threats and opportunities (demand left unmet and markets poorly served are also risks), as a built-in part of every activity and a core element of the SVS. Risks are identified as uncertainties that affect objectives and described so everyone understands them the same way; they are assessed for probability, impact and proximity so they can be ranked and exposure understood; and they are treated through planned responses with owners and actionees, which are carried out, monitored and controlled. Risk is part of doing business and some risk-taking is essential; the approach to risk has to be the same throughout the organization; and the culture has to reward proactive risk management, openness about procedures and roles, reporting of risks, incidents and opportunities, pay that supports all this, and learning from experience. It gives strategy the risks that make outcomes vary (shifts in demand, regulation, competitors, reliance on suppliers, technology, conflicting requirements); controls improvement initiatives; tunes engagement to risk appetite and profiles; requires services to be designed around prioritized risks and changes to be assessed before approval; informs decisions in obtain/build; and keeps delivery at the agreed level, with events managed according to the risk they bring.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.