ABSTRACT
A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A deficiency in operation exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control effectively. It is important to define a control objective as well, since the definition of a design deficiency makes reference to it. Internal auditors' testing procedures have focused primarily on operating deficiencies, but many opportunities exist to add value by examining the design of programs and processes. Design weaknesses can result in longer cycle times, redundancies, and underutilization of the existing operating capacity. Testing the operating integrity of internal controls is a form of inspection.
