Can anyone help me?

In the United States, the management and auditors of publicly held companies must evaluate their internal controls annually. The purpose of the evaluation is to look for any control deficiencies. Doing so will help avoid any penalties such as the $10.5 million that the SEC imposed on Citigroup Inc. as a result of its internal controls failures. See the article from SEC.gov, Citigroup to Pay More Than $10 Million for Books and Records Violations and Inadequate Controls.

You are an external auditor hired by Citigroup to perform an audit. You will be reporting to Citigroups audit committee.

Instructions:

Write a 23 page report for the audit committee in which you:

1. Critique Citigroups internal controls and the purpose they serve.
2. Distinguish between operation and design control deficiency.
3. Determine the reasons that led Citigroup Inc. to pay $10.5 million in penalties.
4. Recommend techniques that will overcome the weaknesses of Citigroups internal controls; justify the recommendation.