Organizational Strategy Goals and Objectives are the specific, measurable, time-bound targets derived from an organization's strategic plan that define what the organization intends to achieve and by when. In the CRISC governance context, they are the authoritative input that shapes risk appetite, determines acceptable risk thresholds, and drives risk management priorities. A strategic GOAL is a broad, directional statement (e.g., 'become the market leader in digital banking by 2027'); a strategic OBJECTIVE is a SMART decomposition of that goal into a trackable target (e.g., 'achieve 40% of retail transactions through digital channels by Q4 2027'). Together, they define the strategic intent that risk professionals must validate, monitor, and protect. They are NOT mission or vision statements (which are aspirational and non-measurable), NOT operational KPIs (which measure execution performance), and NOT synonymous with risk appetite statements — risk appetite is derived FROM objectives, not the other way around.
Where it stops · what it isn't
- —IN SCOPE: Strategic goals and objectives approved at enterprise or business-unit level that carry resource allocation decisions, governance implications, or risk trade-offs
- —IN SCOPE: Objectives that meet SMART criteria — Specific, Measurable, Achievable, Relevant, Time-bound — with explicit success criteria and risk-adjusted metrics
- —IN SCOPE: The cascade of enterprise objectives through business units to individual roles, and the risk implications at each layer
- —OUT OF SCOPE: Mission and vision statements — directional anchors, not measurable commitments; they do not directly trigger risk assessments
- —OUT OF SCOPE: Operational KPIs and performance metrics that measure execution but are not themselves strategic choices subject to risk governance
- —OUT OF SCOPE: Risk appetite and tolerance thresholds — these are outputs derived from strategic objectives, not the objectives themselves (covered in the Risk Appetite and Tolerance cubelet)
- —NOT the same as: Strategic initiatives or projects, which define HOW execution happens; objectives define the WHAT and WHY
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
ENABLESRisk Appetite and Tolerance StatementRisk Identification and AssessmentIT and Cyber Risk Governance Alignment
REQUIRESOrganizational Governance Structure and Oversight
PART OFCRISC Domain 1: Governance
RELATED TOOrganizational Risk Appetite and ToleranceOrganizational Structure, Roles, and Responsibilities
CONSTRAINSStrategic Initiatives and Project Portfolios