Establish and adhere to a formal, written risk governance framework designed by independent risk management and approved by the board or its risk committee, including delegations of authority from the board to management committees and executive officers and the risk limits for material activities; independent risk management reviews and updates it at least annually and as often as needed for improvements in industry practice and changes in risk profile from emerging risks, strategic plans or other internal and external factors.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.