·      Failure by employees to internalize the organization’s mission and objectives.

·      Inaccurate or out-of-date assumptions

·      Undue focus on current conditions

·      Rigid organizational structure

·      Failure to enforce accountability

·      Communication breakdowns

·      Top management failure

refer to the control activities that are performed as part of the various processes within the organization.  Process controls are usually performed by staff employees and low-level management, process control activities tend to focus on specific risks within a process

    involve embedding special code digits that represent a mathematical combination of the other digits in an identification number

involves comparing data that should be the same but is taken from 2 different sources (think of bank reconciliations)

     used to test sequential processing of data, the batch of transactions is represented by one or more control totals that reflect the summation of a common element in the batch (ie: processing multiple sales transactions at once, the control total would be the amount of total sales for the entire day, not just for one batch of sales)

1.Control Environment: the organization’s integrity, attitudes towards ethical dealings, and general competence.

§       Commonly referred to as the Tone at the Top

2.Risk Assessment: Management should put in place a set of procedures whose purpose is to identify, analyze, and manage risks

3.Control Activities: Management must decide how to respond to risky conditions.  Management must assess whether controlling a risk has a net benefit.  If management believes that it is cost effective to respond to a risk then control activities are the actual procedure that are performed to reduce the likelihood or potential impact of the risk in question

4. Information and Communication: Important information is identified, captured and made available to the appropriate persons in the organization

5. Monitoring: the process whereby the organization tracks the effectiveness of internal controls.  Monitoring should provide information about potential and actual breakdowns in the control system that could allow risks to become problems

1.     Internal control is a process, meaning it is something the organization does on an ongoing basis.  Because things are constantly changing internal control needs to be a continuous activity

2.     Internal control is ultimately part of management’s responsibility and failure to design effective controls is itself a deficiency and suggests ineffective management.

3.     Internal Controls have inherent limitations that prevent them from eliminating all risk

components of an organization’s enterprise risk management framework that have audit implications