System and Organization Controls (SOC) 2/CC3 Risk Assessment/14 of 61
CC3.1COSO Principle 6: The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives
Control family: CC3 Risk Assessment
Control description
The following points of focus highlight important characteristics relating to this criterion:
Points of focus specified in the COSO framework:
Operations Objectives
• Reflects Management's Choices — Operations objectives reflect management's choices about structure, industry considerations, and performance of the entity.
• Considers Tolerances for Risk — Management considers the acceptable levels of variation relative to the achievement of operations objectives.
• Includes Operations and Financial Performance Goals — The organization reflects the desired level of operations and financial performance for the entity within operations objectives.
• Forms a Basis for Committing of Resources — Management uses operations objectives as a basis for allocating resources needed to attain desired operations and perations Objectivesfinancial performance.
External Financial Reporting Objectives
• Complies With Applicable Accounting Standards — Financial reporting objectives are consistent with accounting principles suitable and available for that entity. The accounting principles selected are appropriate in the circumstances.
• Considers Materiality — Management considers materiality in financial statement presentation.
• Reflects Entity Activities — External reporting reflects the underlying transactions and events to show qualitative characteristics and assertions.
External Nonfinancial Reporting Objectives
• Complies With Externally Established Frameworks — Management establishes ob?jectives consistent with laws and regulations or standards and frameworks of recognized external organizations.
• Considers the Required Level of Precision — Management reflects the required level of precision and accuracy suitable for user needs and based on criteria established by third parties in nonfinancial reporting.
• Reflects Entity Activities — External reporting reflects the underlying transactions and events within a range of acceptable limits.
Internal Reporting Objectives
• Reflects Management's Choices — Internal reporting provides management with accurate and complete information regarding management's choices and information needed in managing the entity.
• Considers the Required Level of Precision — Management reflects the required level of precision and accuracy suitable for user needs in nonfinancial reporting objectives and materiality within financial reporting objectives.
• Reflects Entity Activities — Internal reporting reflects the underlying transactions and events within a range of acceptable limits Compliance Objectives
• Reflects External Laws and Regulations — Laws and regulations establish minimum standards of conduct, which the entity integrates into compliance objectives.
• Considers Tolerances for Risk — Management considers the acceptable levels of variation relative to the achievement of operations objectives.