What is the purpose of a control objective?

A control objective is a statement describing the desired outcome or purpose to be achieved by implementing one or more controls. It defines "what" needs to be accomplished to mitigate a specific risk to an acceptable level, thereby protecting an asset or ensuring the integrity of a business process. For example, a control objective might be to "ensure that access to sensitive data is restricted to authorized personnel." The specific controls, such as user authentication and access control lists, are then implemented to meet this objective.

B. This describes a risk statement or the output of a risk analysis, which identifies the potential for loss, not the goal of a control.
C. This describes governance and the assignment of roles and responsibilities, which is distinct from the specific purpose of a control.

1. ISACA, IT Risk Fundamentals Study Guide, 2nd Edition, 2020. Chapter 3, "Risk Response," page 69, defines a control objective as "a statement of the desired result or purpose to be achieved by implementing control activities (procedures)."

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018. Each management objective (e.g., APO12 Managed Risk) is supported by practices that are, in essence, control objectives aimed at achieving a desired state. For example, practice APO12.01 is "Collect data," which serves the objective of creating a risk profile.