and Indirect (indirect entity level) - Controls that are not linked to specific transactions, such as the control environment (e.g., tone set by management and hiring practices). It is increasingly difficult to argue that reliance upon controls is reasonable in achieving assertion-level objectives as one travels along this continuum from most precise to least, and as risk increases. A combination of type 3-6 controls above may help reduce the number of type 1 & 2 controls (transaction-level) that require assessment for particular risks, especially in lower-risk, transaction-intensive processes. Under the 2007 guidance, it appears acceptable to place significantly more reliance on the period-end controls (i.e., review of journal entries and account reconciliations) and management review controls than in the past, effectively addressing many of the material misstatement risks and enabling either: a) the elimination of a significant number of transactional controls from the prior-year's scope of testing; or b) reducing related evidence obtained. The number of transaction-level controls may be reduced significantly, particularly for lower-risk accounts. Considerations in testing and evidence decisions The key SEC principle regarding evidence decisions can be summarized as follows: "Align the nature, timing and extent of evaluation procedures on those areas that pose the greatest risks to reliable financial reporting." The SEC has indicated that the sufficiency of evidence required to support the assessment of specific MMR should be based on two factors: a) Financial Element Misstatement Risk ("Misstatement Risk") and b) Control Failure Risk. These two concepts together (the account- or disclosure-related risks and control-related risks) are called "Internal Control over Financial Reporting Risk" or "ICFR" risk. A diagram was included in the guidance (shown in this section) to illustrate this concept; it is the only such diagram, which indicates the emphasis placed on it by the SEC. ICFR risk should be associated with the in-scope controls identified above and may be part of that analysis. This involves the following steps: Link each key control to the "Misstatement Risk" of the related account or disclosure Management assigned a misstatement risk ranking (high, medium or low) for each significant account and disclosure as part of the scoping assessment above. The low, medium, or high ranking assessed should also be associated with the risk statements and control statements related to the account. One way of accomplishing this is to include the ranking within the risk statement and control statement documentation of the company. Many companies use