Gov. Code, § 13404

A risk management system shall include at least the following five internal control components:

(a) Control environment, which is the foundation for internal control that provides the discipline and structure to help an entity achieve its mission, goals, and objectives.

(b) Risk assessment, which is the identification and analysis of risks facing the state entity, including, but not limited to, fraud, errors, waste, and abuse of public resources, as it seeks to achieve its mission, goals, and objectives, and provides the basis for developing appropriate risk responses.

(c) Control activities, which are the actions entity management establishes through policies and procedures to mitigate risks to achieving the state entity’s mission, goals, and objectives to acceptable levels.

(d) Information and communication, which is the quality of information that entity management and other personnel communicate and use to support its internal control.

(e) Monitoring, which are the activities entity management establishes and operates to assess the quality of performance over time and promptly resolve the identified weaknesses, including findings of audits, other reviews, and ongoing assessments.