Management specifies objectives within categories relating to operations, reporting and compliance with sufficient clarity to be able to identify and analyzes risks as a basis for determining how the risks should be managed
The organization specifies objectives with sufficient clarity to enable
the identification and assessment of risks relating to objectives