CGOV.9:4.1 - Identify the objective and exposure

State the objective in terms that let practitioners recognize success and failure. For example, pay the entitled counterparty once, report the corporation’s commitments faithfully or prevent an unauthorized release.

Follow a representative operation through its participants, information, decisions and resulting change. Identify where an error, misuse, collusion or override could defeat the objective. Use existing knowledge and incidents where they answer the question. A complete risk inventory is unnecessary before correcting a known, consequential weakness.

Retain the conditions that matter: transaction population, authority, technology, timing and the consequence of a failure. A control appropriate for a reversible small purchase may be inadequate for an irreversible large payment.