Human error can cause failures although a well-designed internal control environment can help control this to a certain extent.

Dear Friend, --Internal Control is a process designed to provide reasonable assurance that organizational objectives are being achieved. **--Why Internal Controls Fail** 1. Not enforced or monitored 2. Poorly designed 3. Circumvented byishonest employees

Purpose – The purpose of this paper is to investigate the rationale for the failure of management and auditors to identify material internal control weaknesses (ICWs) in their initial Sarbanes‐Oxley Act of 2002 (SOX) 404 reviews, resulting in subsequent restatement of their opinions. Design/methodology/approach – The paper focuses on the factors associated with the failure of management and auditor to identify material internal controls weaknesses in their initial SOX 404 reports. Logistic regression is run on a sample of 56 firms that reported material internal controls weaknesses in their amended internal control reports and a control group of 344 firms that reported material internal controls weaknesses (i.e. ineffective internal controls) in their initial internal control reports for 2004. Findings – The results show that firm size, the use of a Big 4 auditor, the ratio of non‐audit to total fees, and the need for accounting restatements are positively associated with the probability to file an amended internal control report. The number of ICWs and the number of audit committee meetings are negatively associated with the probability to file an amended internal control report. Practical implications – The paper's findings suggest that regulators and corporate boards should consider providing more guidelines on audit committee practices in addition to the audit committee structure. For example, more guidance by the board is needed to ensure that the audit committee is active in overseeing the company's auditor–client relationship and its internal audit function. Originality/value – Empirical findings on factors associated with the failure of management and auditor to identify material ICWs in their SOX 404 review can contribute to an understanding of factors affecting the efficiency of the SOX 404 review by attributing such failure to either inherent factors such as operational complexity and industry membership or to managerial choices in auditor‐client relationship and corporate governance issues. An understanding of these factors can help companies and the Public Company Accounting Oversight Board and the Securities and Exchange Commission in their efforts to improve the effectiveness and the efficiency of the current SOX 404 process.

There are several possible causes of internal control failure. The UK Turnbull report (in paragraph 22) gives examples of causes of failure but this list is not exhaustive. 1. Poor judgement in decision-making. Internal control failures can sometimes arise from individual decisions being made based on inadequate information provision or by inexperienced staff. 2. Human error can cause failures although a well-designed internal control environment can help control this to a certain extent. 3. Control processes being deliberately circumvented by employees and others. It is very difficult to completely prevent deliberate circumvention, especially if an employee has a particular reason (in his or her opinion) to do so, such as the belief that higher bonuses will be earned. 4. Management overriding controls, presumably in the belief that the controls put in place are inconvenient or inappropriate and should not apply to them. 5. The occurrence of unforeseeable circumstances is the final cause referred to in the Turnbull Report. Control systems are designed to cope with a given range of variables and when an event happens outwith that range, the system may be unable to cope.