Risk-based performance

(1) Intent. As used in the definition of internal control, the internal control system design is intended to provide reasonable assurance as to achievement of objectives; when the intent is realized, the system can be deemed effective. (2) Plan; the way a system is supposed to work, contrasted with how it actually works.

Source : COSO Integrated Internal Controls Framework

1. Intent. As used in the definition, enterprise risk management is intended to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance as to achievement of objectives. 2. Plan; the way a process is supposed to work, contrasted with how it actually works.

Source : COSO Integrated Risk Management Framework