An effective system of internal control provides reasonable assurance regarding achievement of an entity's objectives. Because internal control is relevant both to the entity and its subunits, an effective system of internal control may relate to a specific part of the organizational structure. An effective system of internal control reduces, to an acceptable level, the risk of not achieving an objective relating to one, two, or all three categories. It requires that:

Each of the five components of internal control and relevant principles is present and functioning

The five components are operating together in an integrated manner

Risk tolerance is the acceptable level of variation in performance relative to the achievement of objectives. Operating within risk tolerance provides management with greater confidence that the entity will achieve its objectives. The concept of risk tolerance is included in the Framework, as a precondition to internal control, but not as a part of internal control.