An effective system of internal control reduces, to an acceptable level, the risk of not achieving an objective relating to one, two, or all three categories. It requires that:

Each of the five components of internal control and related relevant principles is present and functioning

The five components are operating together in an integrated manner

The phrase "present and functioning" applies to components and principles.

"Present" refers to the determination that components and relevant principles exist in the design and implementation of the system of internal control to achieve specified objectives.

"Functioning" refers to the determination that components and relevant principles continue to exist in the conduct of the system of internal control to achieve specified objectives.

In determining whether a component is present and functioning, senior management with board of director oversight needs to determine to what extent relevant principles are present and functioning. However, a principle being present and functioning does not imply that the organization strives for the highest level of performance in applying that particular principle. Rather, management exercises judgment in balancing the cost and benefit of designing, implementing, and conducting internal control.

The term "internal control deficiency" refers to a shortcoming in a component or components and relevant principle(s) that reduces the likelihood of an entity achieving its objectives. An internal control deficiency or combination of deficiencies that severely reduces the likelihood that the entity can achieve its objectives is referred to as a "major deficiency." A major deficiency is a subset of internal control deficiencies. As such, a major deficiency is by definition also an internal control deficiency.

When a major deficiency exists the organization cannot conclude that it has met the requirements for an effective system of internal control. A major deficiency exists in the system of internal control when management determines that a component and relevant principle are not present or functioning or that components are not operating together. A major deficiency in one component cannot be mitigated to an acceptable level by the presence and functioning of another component. Similarly, a major deficiency in a relevant principle cannot be mitigated to an acceptable level by the presence and functioning of other principles.

In determining whether components and relevant principles are present and functioning, management can consider controls to effect principles. For instance, in assessing whether Principle 8, Assesses Fraud Risk, may not be present and functioning, the organization can consider controls to effect other principles, such as those relating to Principle 3, Establishes Structure, Authority and Responsibility, and Principle 5, Enforces Accountability. By considering controls initially considered in the context of other principles, management may be able to determine that Principle 8, Assesses Fraud Risk, is present and functioning.

Management exercises judgment to assess the severity of an internal control deficiency or combination of deficiencies, in determining whether components and relevant principles are present and functioning, and components are operating together, and ultimately in determining the effectiveness of the entity's system of internal control. Further, these judgments may vary depending on the category of objectives.

The Framework describes points of focus that are important characteristics of principles. Management may determine that some of these points of focus are not suitable or relevant and may identify and consider others based on specific circumstances of the entity. Points of focus may assist management in designing, implementing, and conducting internal control and in assessing whether the relevant principles are, in fact, present and functioning. The Framework does not require that management assess separately whether points of focus are in place.