What are the Limitations of Internal Controls?

A system of controls does not provide absolute assurance that the control objectives of an organization will be met. Instead, there are several inherent limitations in any system that reduce the level of assurance. These inherent limitations are as follows:

Collusion. Two or more people who are intended by a system of control to keep watch over each other could instead collude to circumvent the system. Since this essentially eliminates a control, the probability of losses being incurred is greatly increased.
Human error. A person involved in a control system could simply make a mistake, perhaps forgetting to use a control step. Or, the person does not understand how a control system is to be used, or does not understand the instructions associated with the system. This may be caused by the assignment of the wrong person to a task.
Management override. Someone on the management team who has the authority to do so could override any aspect of a control system for his personal advantage. Consequently, if anyone on the management team is ethically challenged, then this may lead to weaker controls.
Missing segregation of duties. A control system might have been designed with an insufficient segregation of duties, so that one person can interfere with its proper operation.

Consequently, it must be accepted that no system of internal controls is perfect. There is always a way in which it can fail or be circumvented.