The Treadway Commission was concerned about the fraudulent financial reporting that was occurring in the United States. Yet, numerous significant instances of fraudulent financial reporting occurred after publication of the COSO report.

Question: In the context of the five components of internal control cited by the COSO report, discuss what appears to have gone wrong in own words.

a) Think about the five components of control - control environment, risk assessment, control activities, information & communication, and monitoring.

Limitations on Internal Control

Monitoring the effectiveness of an internal control system should be a continuous process on the

part of both management and performance auditors. This regular scrutiny acknowledges that

an internal control system is not fail safe. Too many factors can impinge on the adequacy of the

controls. For example:

Controls can quickly become outdated because of changing organizational conditions.

Control activities may be strong, but the control environment or work setting may become

weak.

Inappropriate controls may be in place. For example, an entity may be using detection

controls, designed to identify - after the fact - that errors or irregularities have occurred,

where it would have been better to adopt a prevention control designed to deter the

possibility of errors or irregularities occurring.

Too many or too few controls may affect the ability of an agency to effectively fulfill its

mission.

Intentional or unintentional staff deviation from prescribed controls can render a system

useless. Human factors such as boredom, personal problems, or other distractions can

result in errors.

Inadequately trained or incompetent employees can reduce the effectiveness of controls.

Collusion among employees or managers may nullify the internal control system.

No internal control system can provide an absolute guarantee that errors or irregularities

will not occur. It can only provide reasonable assurance that management objectives will

be achieved. This assurance can be maintained if (a) management continuously monitors

the effectiveness of the controls in place, taking into consideration the costs and benefits

associated with those controls and (b) auditors provide independent assessments that the

control system is working.