The board keeps oversight of how operational risk is managed in three places: in the business lines, in the independent operational risk function, and in internal or external audit. Senior management answers for each of those areas staying inside the firm's tolerance for disruption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.