Which of the following best describes the underlying premise of the COSO enterprise risk management framework?