The board or an appropriate board committee should appoint a CEO and appoint or approve the appointment of a Chief Audit Executive and one or more Chief Risk Executives with the skills and abilities for their roles.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.