Why are there not any Risk Statements with the Control Objectives?
The provision of risk statements was seriously considered and investigated during the research and review phase of the initial COBIT project, but not retained because management preferred the pro-active approach (objects are to be achieved) over the reactive approach (risks are to be mitigated). The risk approach comes in at the end of the audit guidelines when the risk of not implementing the controls is substantiated. In the application of COBIT, the risk approach is certainly useful when management decides which controls to implement or when auditors decide which control objectives to review. Both of these decisions depend entirely on the risk environment.
