Maintain a proportionate risk management function, policies and measurement methods to identify, measure, manage and monitor financial, technological and other risks; staff it with qualified people under a head of risk who (if not the compliance officer) reports to the Board; review policies on material changes; and give the Board at least quarterly risk exposure reports covering financial stability (soundness, market risk with value-at-risk and stress testing, credit risk with ratings, limits and margin policies, liquidity with concentration limits and maturity monitoring), market conduct (strategy, onboarding, organisation, operational, governance, regulator relationships, cybersecurity), compliance (financial crime, outsourcing and counterparties, risk systems, compliance function, continuity) and consumer protection risks (promotions, legal, disclosures, client assets).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.