Requirement
The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
Points of Focus
Operations Objectives — Reflects Management's Choices
Requirement: Operations objectives reflect management's choices about structure, industry considerations, and performance of the entity.
Operations Objectives — Considers Tolerances for Risk
Requirement: Management considers the acceptable levels of variation relative to the achievement of operations objectives.
Operations Objectives — Includes Operations and Financial Performance Goals
Requirement: The organization reflects the desired level of operations and financial performance for the entity within operations objectives.
Operations Objectives — Forms a Basis for Committing of Resources
Requirement: Management uses operations objectives as a basis for allocating resources needed to attain desired operations and financial performance.
External Financial Reporting Objectives — Complies With Applicable Accounting Standards
Requirement: Financial reporting objectives are consistent with accounting principles suitable and available for that entity. The accounting principles selected are appropriate in the circumstances.
External Financial Reporting Objectives — Considers Materiality
Requirement: Management considers materiality in financial statement presentation.
External Financial Reporting Objectives — Reflects Entity Activities
Requirement: External reporting reflects the underlying transactions and events to show qualitative characteristics and assertions.
External Nonfinancial Reporting Objectives — Complies With Externally Established Frameworks
Requirement: Management establishes objectives consistent with laws and regulations or standards and frameworks of recognized external organizations.
External Nonfinancial Reporting Objectives — Considers the Required Level of Precision
Requirement: Management reflects the required level of precision and accuracy suitable for user needs and based on criteria established by third parties in nonfinancial reporting.
External Nonfinancial Reporting Objectives — Reflects Entity Activities
Requirement: External reporting reflects the underlying transactions and events within a range of acceptable limits.
Internal Reporting Objectives — Reflects Management's Choices
Requirement: Internal reporting provides management with accurate and complete information regarding management's choices and information needed in managing the entity.
Internal Reporting Objectives — Considers the Required Level of Precision
Requirement: Management reflects the required level of precision and accuracy suitable for user needs in nonfinancial reporting objectives and materiality within financial reporting objectives.
Internal Reporting Objectives — Reflects Entity Activities
Requirement: Internal reporting reflects the underlying transactions and events within a range of acceptable limits.
Compliance Objectives — Reflects External Laws and Regulations
Requirement: Laws and regulations establish minimum standards of conduct, which the entity integrates into compliance objectives.
Compliance Objectives — Considers Tolerances for Risk
Requirement: Management considers the acceptable levels of variation relative to the achievement of operations objectives.
Trust Services Engagements — Establishes Sub-Objectives for Risk Assessment
Requirement: Management identifies sub-objectives for use in risk assessment related to security, availability, processing integrity, confidentiality, or privacy to support the achievement of the entity’s objectives.
Explanation
Risk assessment only works if the organization first states clearly what it is trying to achieve — its operational, reporting, and compliance goals, plus security and privacy sub-objectives. Auditors look for documented objectives specific enough that management can identify what could go wrong and decide how much risk is acceptable.
