The board sets, and revisits on a schedule, how much disruption from operational risk the firm is prepared to live with, both for the enterprise as a whole and for each of its core business lines and critical operations. In doing so it states the firm's tolerance for disruption, having regard to the firm's risk profile and to what its operating environment (systems, processes, infrastructure, risk capability, expertise) can actually sustain. Existing regulation and guidance, and analysis of severe but plausible scenarios, feed that judgement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.