Determine if management establishes strategic level objectives which are appropriate to the size and complexity of the entity, and if operational level objectives are consistent with the overall strategy.
Determine if strategic level objectives and related risks are periodically updated and presented to those charged with governance for review and approval.
Determine if management has a process for:
Identifying business risks relevant to financial reporting objectives;
Estimating the significance of risks;
Assessing the likelihood of their occurrence; and
Deciding about actions to address those risks
Determine if management has established a formal process for managing changes that can have significant impact on the entity (e.g. changes in operating environment, new personnel, new information systems, rapid growth, new accounting pronouncements etc).