CA Sakshi, the statutory auditor of ZMC Ltd., a medium-sized trading company, was reviewing the company's internal control system as part of her…

In the given case, CA Sakshi, the statutory auditor identified various lapses in the company's internal control system, such as employees failing to act on important reports, duplicate payments, collusion to override system checks, management override of procedures and lack of segregation of duties due to limited staff. While discussing the same with management, she explained that such deficiencies, despite the presence of internal controls, are not rare due to the inherent limitations of internal control, which include: Internal control can provide only reasonable assurance: Internal control, no matter how effective, can provide an entity with only reasonable assurance about achieving the entity's financial reporting objectives. The likelihood of their achievement is affected by inherent limitations of internal control.Human judgment in decision-making: Realities that human judgment in decision-making can be faulty and that breakdowns in internal control can occur because of human error.Lack of understanding the purpose: The operation of a control may not be effective, such as where information produced for the purposes of internal control (for example, an exception report) is not effectively used because the individual responsible for reviewing the information does not understand its purpose or fails to take appropriate action.Collusion among People: Controls can be circumvented by the collusion of two or more people or inappropriate management override of internal control. For example, management may enter into side agreements with customers that alter the terms and conditions of the entity's standard sales contracts, which may result in improper revenue recognition. Also, edit checks in a software program that are designed to identify and report transactions that exceed specified credit limits may be overridden or disabled.Judgements by Management: In designing and implementing controls, management may make judgments on the nature and extent of the controls it chooses to implement, and the nature and extent of the risks it chooses to assume.