Neumann and Tides quickly found that their new work roles were tension-packed. The source of the tension was management's concern that Deloitte, which at the time was completing its 2006 audit of Boeing's financial statements, would report one or more "material weaknesses" in the company's IT financial reporting controls. Management realized that Boeing would face significant adverse consequences if such weaknesses were reported, including a likely drop in the company's stock price.
By early February 2007, Neumann and Tides had decided, independently of each other, that there were major problems in Boeing's IT financial reporting controls. The two internal auditors, again independently of each other, repeatedly voiced those concerns over the next few months. Collectively, Neumann and Tides notified their superiors of the apparent internal control weaknesses on more than two dozen occasions.
Neumann and Tides identified seven potential problems in Boeing's IT financial reporting controls. Their primary concerns, however, revolved around two of those issues. First, Neumann and Tides believed that the PwC contract auditors were being given "managerial authority over Boeing employees," including the company's internal auditors. The SEC's rules for corporate audit committees expressly require that a company's internal auditors be controlled by its audit committee.
Second, and more importantly, Neumann and Tides questioned the overall integrity of Boeing's control environment that had been established by the company's top executives. In particular, they charged that those executives were intentionally undermining the annual SOX-mandated assessment of the company's financial reporting controls. Among specific allegations, the two internal auditors suggested that Boeing management was "potentially misleading the external auditors" by permitting company insiders to "change audit results." They also suggested management was "permitting other tampering with the official internal audit records," and had concealed "failed controls."
Despite the concerns expressed by Neumann and Tides, Boeing management rated the company's internal controls over financial reporting as effective for the company's fiscal years ending December 31, 2006, and 2007. Likewise, for both years, Deloitte issued an unqualified opinion on Boeing's internal controls, meaning that the Deloitte auditors found no indication of one or more material weaknesses in those controls during either of those years.

Questions
1. The COSO internal control framework identifies five internal control components. Which of those components is most relevant to the procedures that SOX mandates public companies establish to enable, if not encourage, whistleblowing by corporate employees?
2. Explain the difference between a "significant deficiency" and "material weakness" in internal control. Provide an example of each.
3. Assume that the PwC contract auditors did, in fact, exert "managerial authority" over Boeing employees? What internal control problems or issues would that have posed for Boeing?
4. Would it have been unethical or otherwise inappropriate for Neumann and Tides to have directly communicated their concerns regarding Boeing's IT controls to the company's Deloitte auditors? Explain. Assuming that Neumann and Tides had done just that, how should the Deloitte auditors have responded?
5. Was it ethical for Boeing to monitor the computers and email of Neumann and Tides during the investigation to determine whether one or more employees were communicating with members of the news media? Defend your answer.