Have a comprehensive written risk appetite statement that is the basis for the framework, with qualitative components describing a safe and sound risk culture and how risks, including hard-to-quantify ones, are assessed and accepted, and quantitative limits that incorporate sound stress testing where appropriate and address earnings, capital and liquidity, set with capital and liquidity buffers so that management and the board reduce risk before the risk profile jeopardizes earnings, liquidity or capital; aggregate limits should, where possible, be disaggregated to front line units.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.