The framework should require review and approval of the risk appetite statement by the board or its risk committee at least annually, or more often with the size and volatility of risks and material changes in business model, strategy, risk profile or market conditions (monitoring and reporting in G.3 to G.5 more often as the size and volatility of risks or material changes require).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.