To better understand inherent and residual risk within the organization

To gain objective insight into the effectiveness and efficiency of controls

To demonstrate compliance with regulatory and legal control requirements

To facilitate timely and accurate updates to the risk register