The COSO Internal Control-Integrated Framework, a standard of internal control widely used for SOX compliance, states: "A precondition to risk assessment is the establishment of objectives..." and "Risk assessment is the identification and analysis of relevant risks to achievement of the objectives." The SOX guidance states several hierarchical levels at which risk assessment may occur, such as entity, account, assertion, process, and transaction class. Objectives, risks, and controls may be analyzed at each of these levels. The concept of a top-down risk assessment means considering the higher-levels of the framework first, to filter from consideration as much of the lower-level assessment activity as possible. There are many approaches to top-down risk assessment. Management may explicitly document control objectives, or use texts and other references to ensure their risk statement and control statement documentation is complete. There are two primary levels at which objectives (and also controls) are defined: entity-level and assertion level. An example of an entity-level control objective is: "Employees are aware of the Company's Code of Conduct." The COSO 1992–1994 Framework defines each of the five components of internal control (i.e., Control Environment, Risk Assessment, Information & Communication, Monitoring, and Control Activities). Evaluation suggestions are included at the end of key COSO chapters and in the "Evaluation Tools" volume; these can be modified into objective statements. An example of an assertion-level control objective is "Revenue is recognized only upon the satisfaction of a performance obligation." Lists of assertion-level control objectives are available in most financial auditing textbooks. Excellent examples are also available in AICPA Statement on Auditing Standards No. 110 (SAS 110) for the inventory process. SAS 106 includes the latest guidance on financial statement assertions. Control objectives may be organized within processes, to help organize the documentation, ownership and TDRA approach. Typical financial processes include expense & accounts payable (purchase to payment), payroll, revenue and accounts receivable (order to cash collection), capital assets, etc. This is how most auditing textbooks organize control objectives. Processes can also be risk-ranked. COSO issued revised guidance in 2013 effective for companies with year-end dates after December 15, 2014. This essentially requires control statements to be referenced to 17 "principles" beneath the five COSO "components." There are approximately 80 "points of focus" that can be evaluated specifically against the controls of the company, to form a conclusion about the 17 principles (i.e., each principle has several relevant points of focus). Most of