ion The tone at the top, organizational attitude, awareness, action Risk Assessment Identify objectives, risks, and measures to deal with risks Control Activities The work flows, policies and procedures used Information and Communication Reporting and communication up, down, across the organization Monit