The operational risk function keeps the internal controls that matter to core business lines and critical operations under regular review, tests them and refreshes them, and does the same for controls that third parties perform on the firm's behalf.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.