Why are there no risk statements with the control objectives?
The provision of risk statements was seriously considered and investigated during the research and review phase of the initial COBIT project, but not retained because management preferred the proactive approach (objects are to be achieved) over the reactive approach (risks are to be mitigated). The risk approach comes in at the end of the IT Assurance Guide when the risk of not implementing the controls is substantiated. In the application of COBIT, the risk approach is certainly useful when management decides which controls to implement or when auditors decide which control objectives to review. Both of these decisions depend entirely on the risk environment. In the management guidelines the goals and metrics can be used as risk indicators by considering their absence or lack of positive outcomes. Also, the control practices provide risk and value statements at the control objective level, indicating the risks of not implementing a control objective and the value of improving the cont
