A risk- and opportunity-based process the organisation can run has five steps. It fixes its ESG strategies and priorities for the internal and external risks and opportunities it faces. It pins down the particular ESG risks and opportunities that could touch it or its interested parties. It evaluates them, analysing and checking how likely each is and what it would do to outcomes over near, middle and distant horizons, interested parties included. It treats them within its appetite by picking a strategy for each (acceptance, adaptation, avoidance, escalation, innovation, mitigation, monitoring, reduction, transfer and so on) and putting in place the controls, policies, procedures and other means to deal with them. And it keeps watch on them systematically and continuously, reviewing regularly to catch any that have drifted outside appetite or tolerance and bringing them back, and reporting regularly to the governing body and, where fitting, to regulators and other interested parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.