Organization-wide risk management and internal control are complementary because both support the achievement of organizational objectives, but they perform different and mutually reinforcing roles. Risk management identifies, assesses, prioritizes, and responds to uncertainties that could affect objectives. Internal controls provide policies, procedures, activities, and other mechanisms that help execute selected risk responses and keep risk within acceptable levels. Risk management is not simply a centralized management function because responsibility for managing risk exists throughout the organization. Nor is it limited to compiling an inventory of risks. Governance and culture are important elements of enterprise risk management, but they do not constitute its entire focus. The most accurate description is therefore that risk management complements the internal-control system by providing a broader framework for identifying and managing organizational uncertainty.