The Framework requires judgment in designing, implementing, and conducting internal control and assessing its effectiveness. The use of judgment enhances management's ability to make better decisions about internal control, but cannot guarantee perfect outcomes.

Within the boundaries established by laws, rules, regulations, and standards, management exercises judgement in important areas such as:

For example, in preparing financial statements, management exercises judgment in complying with external financial reporting requirements. Management considers how identified risks to specified financial reporting objectives and sub-objectives should be managed. Management's alternatives for responding to risks may be more limited compared with some other categories of objectives. That is, management is less likely to accept a risk than to reduce the risk. For external financial reporting objectives relating to financial statements prepared for external purposes, risk acceptance should occur only when identified risks could not, individually or in aggregate, exceed the risk threshold and result in a material omission or misstatement.

Management also exercises judgment in specifying and using suitable accounting principles, particularly those relating to subjective measurements and complex transactions. For instance, management exercises judgment in making assumptions and using data in developing accounting estimates, in applying accounting principles to complex transactions, and in preparing reliable and transparent presentations and disclosures. Internal control over external financial reporting addresses the potential for bias in exercising judgment that could lead to a material omission or misstatement in external financial reporting.