The original framework noted that internal control can be judged effective in each of the three categories, respectively, if the board of directors and management have reasonable assurance that:

The original framework noted that achievement of operations objectives is not always within the entity's control. For these operations objectives, the system of internal control can provide reasonable assurance only that management and, in its oversight role, the board are made aware, in a timely manner, of the extent to which the entity is moving toward those objectives.

The Framework acknowledges that achievement of some operations objectives is not always within the organization's control and in those instances retains the view set out in the original framework. The Framework also recognizes that when external events are unlikely to have a significant impact on the achievement of specified objectives, an organization may be able to attain reasonable assurance those objectives can be achieved.