Both Internal Control—Integrated Framework and Enterprise Risk Management—Integrated Framework cover all reports developed by an entity, disseminated both internally and externally. These include reports used internally by management and those issued to external parties, including regulatory filings and reports to other stakeholders.

The two publications handle categories of objectives differently. While both specify the three categories of objectives of operations, reporting, and compliance, ERM Framework adds a fourth category: strategic objectives (illustrated in the diagram below). Strategic objectives operate at a higher level than the others. They flow from an entity's mission or vision, and the operations, reporting, and compliance objectives should be aligned with them. Enterprise risk management is applied in setting strategies, as well as in working toward achievement of objectives in the other three categories.

An underlying premise of enterprise risk management is that every entity exists to provide value for its stakeholders. Strategic objectives reflect management's choice of how the entity will seek to create value for its stakeholders. Related objectives (referring to operations, reporting, and compliance objectives in the ERM Framework) flow from these strategic objectives. While enterprise risk management focuses on how an entity creates, preserves, and realizes value, internal control focuses primarily on the achievement of specified objectives.

Enterprise risk management is often viewed as being more forward-looking, considering how much risk the organization is willing to accept, how risks are both created and mitigated from strategic choices, and how emerging risks may impact the organization. In contrast, internal control focuses on whether the organization is mitigating risks to the achievement of specified objectives. In this context, internal control is often more retrospective than prospective.