An important responsibility of the board/council is identifying and evaluating the external and internal factors that impact the organisation and clarifying the priorities in addressing them. For example, privacy is a growing concern around the world and has serious implications for most organisations. The extent to which privacy should receive attention, and the priority it be given, is a decision of the board/council of the organisation. Some stakeholders, for instance regulators, may place a high level of importance on respecting individuals' rights to privacy, whilst others may choose differently.

Once the direction regarding "what" is required is given, its up to the responsible management to determine "how" to respond to that direction and deliver "what" is required. A management system is an effective and efficient way to manage "how" operations are executed and capability improved. Numerous activities across many processes will need to be choreographed to achieve the desired results. The management system provides the basis for planning, executing, monitoring and acting in response to the activities and related incidents.

Processes organise activities around a common outcome and help formalise the work required to succeed at doing what is required.