Management has not predefined relevant objectives.
Such objectives are incompatible with broader objectives.
Management has not identified relevant risks to achieving its objectives.
Management does not have a basis for determining which risks are most critical.
Management has not ensured mitigation of critical operating risks.
Audit tests detect key risks not previously contemplated by management.