Risk-based performance

A perceived, potential or real internal control shortcoming, or an opportunity to strengthen the internal control system to provide a greater likelihood that the entity’s objectives are achieved.

Source : COSO Integrated Internal Controls Framework

A condition within enterprise risk management worthy of attention that may represent a perceived, potential, or real shortcoming, or an opportunity to strengthen enterprise risk management to provide a greater likelihood that the entity’s objectives will be achieved.

Source : COSO Integrated Risk Management Framework