Strategic objectives at the enterprise level is a prerequisite for risk assessment, since: these must be defined so that management can identify risks and take the necessary actions to manage them. Effective risk assessment adds maximum value to all the organization's activities, increases the likelihood of success and reduces the probability of failure in achieving the institution's objectives.
Control activities are policies and procedures, as well as actions by individuals to implement the policies, and thus help ensure that the management directives identified as necessary to manage risks are being carried out. Control activities can be divided into three categories, based on the nature of the entity's objectives to which they relate: operations, financial reporting, or compliance. While some controls relate to only one area, they often overlap.
Depending on the circumstances, a particular control activity may help satisfy the entity's objectives in more than one of the three categories. Thus, operational controls may also help to ensure reliable financial information, financial reporting controls may serve to effect compliance, and so on.
Procedures must be in place to ensure that transactions are coded and classified in the defined accounting accounts in the correct periods so as to facilitate the preparation of financial statements in accordance with generally accepted accounting principles and the criteria defined by the entity.
To this end, the recording, classification and period allocation policies shall be clearly defined and with an appropriate assignment of responsibilities, all transactions must be supported by documentation and reflected in their corresponding records, such information will serve as a tool to ultimately ensure the achievement of the established objectives.