The CEO should be responsible for developing a written strategic plan, with input from front line units, IRM and internal audit, covering at least three years, which contains a comprehensive assessment of current and prospective risks, articulates the mission statement and strategic objectives and how they will be achieved, explains how the risk governance framework will be updated for the risk profile the plan projects, and is reviewed, updated and approved as needed when the risk profile or operating environment changes unexpectedly; the board should evaluate and approve the plan and monitor its implementation at least annually.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.