When comparing the COSO internal control framework with the COSO enterprise risk management framework, which of the following categories is unique to the latter?