which theft or loss could occur and determining if existing control procedures effectively manage the risk to an acceptable level. The risk that senior management might override important financial controls to manipulate financial reporting is also a key area of focus in the fraud risk assessment. In practice, many companies combine the objective and risk statements when describing MMR. These MMR statements serve as a target, focusing efforts to identify mitigating controls. Identify controls that address the material misstatement risks (MMR) For each MMR, management determines which control (or controls) address the risk "sufficiently" and "precisely" (PCAOB AS#5) or "effectively" (SEC Guidance) enough to mitigate it. The word "mitigate" in this context means the control (or controls) reduces the likelihood of material error presented by the MMR to a "remote" probability. This level of assurance is required because a material weakness must be disclosed if there is a "reasonably possible" or "probable" possibility of a material misstatement of a significant account. Even though multiple controls may bear on the risk, only those that address it as defined above are included in the assessment. In practice, these are called the "in-scope" or "key" controls that require testing. The SEC Guidance defines the probability terms as follows, per FAS5 Accounting for Contingent Liabilities: "Probable: The future event or events are likely to occur." "Reasonably possible: The chance of the future event or events occurring is more than remote but less than likely." "Remote: The chance of the future event or events occurring is slight." Judgment is typically the best guide for selecting the most important controls relative to a particular risk for testing. PCAOB AS5 introduces a three-level framework describing entity-level controls at varying levels of precision (direct, monitoring, and indirect.) As a practical matter, control precision by type of control, in order of most precise to least, may be interpreted as: Transaction-specific (transaction-level) – Authorization or review (or preventive system controls) related to specific, individual transactions; Transaction summary (transaction-level) – Review of reports listing individual transactions; Period-end reporting (account-level) – Journal entry review, account reconciliations or detailed account analysis (e.g., utility spending per store); Management review controls (direct entity level) – Fluctuation analyses of income statement accounts at varying levels of aggregation or monthly reporting package containing summarized financial and operational information; Monitoring controls (monitoring entity level) - Self-assessment and internal audit reviews to verify controls are designed and implemented effectively;