the principles and points of focus relate to entity-level controls. As of June 2013 the approaches used in practice were in the early stages of development. One approach would be to add the principles and points of focus as criteria within a database and reference each to the relevant controls that address them. Identify material risks to the achievement of the objectives One definition of risk is anything that can interfere with the achievement of an objective. A risk statement is an expression of "what can go wrong." Under the 2007 guidance (i.e., SEC interpretive guidance and PCAOB AS5), those risks that inherently have a "reasonably possible" likelihood of causing a material error in the account balance or disclosure are the material misstatement risks ("MMR"). Note that this is a slight amendment to the "more than remote" likelihood language of PCAOB AS2, intended to limit the scope to fewer, more critical material risks and related controls. An example of a risk statement corresponding to the above assertion level control objective might be: "The risk that revenue is recognized before the delivery of products and services." Note that this reads very similarly to the control objective, only stated in the negative. Management develops a listing of MMR, linked to the specific accounts and/or control objectives developed above. MMR may be identified by asking the question: "What can go wrong related to the account, assertion or objective?" MMR may arise within the accounting function (e.g., regarding estimates, judgments, and policy decisions) or the internal and external environment (e.g., corporate departments that feed the accounting department information, economic and stock market variables, etc.) Communication interfaces, changes (people, process or systems), fraud vulnerability, management override of controls, incentive structure, complex transactions, and degree of judgment or human intervention involved in processing are other high-risk topics. In general, management considers questions such as: What is really difficult to get right? What accounting problems have we had in the past? What has changed? Who might be capable or motivated to commit fraud or fraudulent financial reporting? As a high percentage of financial frauds historically have involved the overstatement of revenue, such accounts typically merit additional attention. AICPA Statement on Auditing Standards No. 109 (SAS 109) also provides helpful guidance regarding financial risk assessment. Under the 2007 guidance, companies are required to perform a fraud risk assessment and assess related controls. This typically involves identifying scenarios in