° Predefinition of objectives.
° Compatibility of objectives.
° Identification of risks to achieving objectives.
° Judgment of which risks are critical.
° Determination of actions to mitigate risks.
If any one of these factors is absent, an unsatisfactory rating is generally warranted. Furthermore, audit inquiries and tests should be designed to determine if there are key risks not contemplated by management. If such risks are identified and deemed critical, an unsatisfactory rating should be rendered on that basis alone, even if all the factors listed are present.