The board should actively oversee risk-taking and hold management accountable for adhering to the framework, and may rely on IRM and internal audit assessments and reports to question, challenge and when necessary oppose management recommendations and decisions that could push the risk profile beyond appetite or jeopardize safety and soundness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.