Answer
An Internal Control system can provide only reasonable assurance that the management‟s objectives in establishing the system are achieved. That is, no internal control system can provide absolute assurance that the control objectives are achieved. This is due to the fact that any internal control system has certain internal limitations. The limitations may arise due to:
i. Management‟s usual requirement that the cost of an internal control does not exceed the expected benefits to be derived.
ii. Most internal controls tend to be directed at routine transactions rather than non-routine transactions.
iii. The potential for human error due to carelessness, distraction, mistakes of judgment and the misunderstanding of instructions.
iv. The possibility of circumvention of internal controls through the collusion of a member of management or an employee with parties outside or inside the entity.
v. The possibility that a person responsible for exercising an internal control could abuse that responsibility, for example, a member of management overriding an internal control.
vi. The possibility that procedures may become inadequate due to changes in conditions, and compliance with procedures may deteriorate. Controls has to be cost-effective.
The inherent limitation of internal control system requires the auditor to perform substantive procedure to be able to express an opinion.