Limitations

Internal control only provides reasonable assurance of achieving objectives. It cannot provide absolute assurance because any
system of internal control has the following inherent limitations:

◙ Established objectives must be suitable for internal control.

■ For example, if an entity establishes unrealistic objectives, the system of internal controls will be ineffective.

◙ Human judgment is faulty, and controls may fail because of simple errors or mistakes.
◙ Controls may fail due to breakdowns (e.g., employee misunderstanding, carelessness, or fatigue).
◙ Management may inappropriately override internal controls, e.g., to fraudulently achieve revenue projections or hide liabilities.
◙ Manual or automated controls can be circumvented by collusion.
◙ External events are beyond an organization’s control.