The Treadway Commission was concerned about the fraudulent financial reporting that was occurring in the United States. Yet, numerous significant instances of fraudulent financial reporting occurred after publication of the COSO report.

Question: In the context of the five components of internal control cited by the COSO report, discuss what appears to have gone wrong in own words along with parts A through F for this question prompt. (Please Note: Position and exceptions, if any, are clearly stated. Organization of the argument is completely and clearly outlined and implemented. Research selected is highly relevant to the argument, is presented accurately and completely the method, results, and implications are all presented accurately; Theory is relevant, accurately described and all relevant components are included; relationship between research and theory is clearly articulated and accurate. Conclusion is clearly stated and connections to the research and position are clear and relevant. The underlying logic is explicit. Paper is coherently organized and the logic is easy to follow. There are no spelling or grammatical errors and terminology is clearly defined. Writing is clear and concise and persuasive.)

a) Think about the five components of control - control environment, risk assessment, control activities, information & communication, and monitoring.

b) Do Boards of Directors assess management's attitude, philosophy, and operating style? Do they assess the competence of staff and managers?

c) Do the auditors do the same? Have you researched the SEC web site and its enforcement actions against CPA firms? What are they saying about the quality of the audits the big firms are doing?

d) Have you researched the quality of the risk assessments that occurred with companies that have encountered big problems? For example - companies who have had major breaches in their computer systems, did they do an adequate assessment of those risks and if they did, what controls did they put in place?

e) Have you looked at the opinions offered by auditors on the CEO's certification of the companies internal controls? Do they ever cite problems with companies that have suffered major frauds or operational problems? You can get that information at the SEC's web site.

f) What about government audits? Do State auditors discuss the five components?

Limitations on Internal Control Monitoring the effectiveness of an internal control system should be a continuous process on the part of both management and performance auditors. This regular scrutiny acknowledges that an internal control system is not fail safe. Too many factors can impinge on the adequacy of the controls. For example: Controls can quickly become outdated because of changing organizational conditions. Control activities may be strong, but the control environment or work setting may become weak. Inappropriate controls may be in place. For example, an entity may be using detection controls, designed to identify after the fact that errors or irregularities have occurred, where it would have been better to adopt a prevention control designed to deter the possibility of errors or irregularities occurring. Too many or too few controls may affect the ability of an agency to effectively fulfill its mission. Intentional or unintentional staff deviation from prescribed controls can render a system useless. Human factors such as boredom, personal problems, or other distractions can result in errors. Inadequately trained or incompetent employees can reduce the effectiveness of controls. Collusion among employees or managers may nullify the internal control system. No internal control system can provide an absolute guarantee that errors or irregularities will not occur. It can only provide reasonable assurance that management objectives will be achieved. This assurance can be maintained if (a) management continuously monitors

the effectiveness of the controls in place, taking into consideration the costs and benefits associated with those controls and (b) auditors provide independent assessments that the control system is working.