Why Strong Controls Still Have Limitations

A strong control reduces risk; it does not make failure impossible. Understanding the limits of a control system helps management improve its protection and helps auditors avoid overstating what the evidence supports.

Begin with the objective

Consider a hypothetical purchase-release process. One person prepares the request, a second reviews supporting information, and the system checks the approval limit before releasing the order. That design can reduce the risk of an unsupported purchase. It cannot establish that every input is correct or that every review is meaningful.

Ask what the control is expected to protect, how it works, what information it depends on and which routes allow an exception. A list of approvals is less useful than an explanation of the risk each approval addresses.

Judgment can be wrong

A reviewer may misunderstand an unusual contract, accept an incomplete explanation or apply yesterday's assumptions to today's conditions. The review can occur and still produce a poor decision.

For the illustrative purchase, the useful response might include clearer review criteria, access to supporting records, escalation of unfamiliar terms and a second specialist review where the exposure justifies it. Adding another signature without changing the information available may leave the same weakness in place.

Execution can break down

A control may be skipped during a busy period, performed with an outdated report or recorded after the event. People can make mistakes; automated checks can depend on incorrect configuration or incomplete inputs.

Identify the actual failure route. Examine timestamps, source records and exception handling. A control described accurately in a procedure manual may still require operational evidence before anyone relies on it.

Separation can be bypassed

Segregation of responsibilities limits what one person can do alone. It does not eliminate the possibility that people cooperate to defeat the intended checks. Independent corroboration and review of unusual activity can strengthen the response, but no single safeguard establishes that collusion is impossible.

An override also needs context. A documented emergency intervention under authorized governance is different from an improper bypass. Determine who had authority, why the normal route was changed, what evidence remains and whether the exception received appropriate follow-up.

A working control can become outdated

A new purchasing channel, staff change, revised authority limit or system migration can alter the assumptions behind a control. A successful test from an earlier period does not establish that the same protection continues indefinitely.

Set a practical trigger for reassessment. For the hypothetical process, a new supplier portal should prompt review of request access, verification, approval routing and the completeness of downstream records.

Limitations do not excuse deficiencies

PCAOB AS 2201, in its US internal-control-over-financial-reporting context, recognizes human judgment, human failures, collusion and improper management override as limitations. It also explains that safeguards can reduce the resulting risk without eliminating it.

That principle does not justify accepting a known control gap without evaluation. Assess the exposure, the controls that address it, the evidence of operation and whether additional action is necessary. An inherent possibility of failure and an identified deficiency require different explanations.

Make the remaining exposure visible

Record what the system can reasonably protect, where its dependencies and exceptions sit, how changes are monitored and which issues remain unresolved. Explain the conclusion in relation to the objective and period assessed.

The useful promise is disciplined risk reduction supported by evidence—not a claim that the system can never fail.

Beyond the numbers. Inside the business.