With the enhanced focus on risk, the ERM Framework expands the internal control framework's risk assessment component, creating three components: event identification, risk assessment, and risk response (shown in the illustration below).

The objective-setting component of the ERM Framework considers the process used by management and the board for setting operations, reporting, and compliance objectives. Setting risk appetite and risk tolerance are key tenets of enterprise risk management. In contrast, internal control views the setting of objectives and risk tolerance as preconditions to an effective system of internal control.