An effective system of internal control reduces, to an acceptable level, the risk of not achieving an objective relating to one, two, or all three categories. It requires that:

Each of the five components of internal control and relevant principles is present and functioning

The five components are operating together in an integrated manner

The Framework views all components of internal control as suitable and relevant to all entities.

The Framework requires that all components operate together in an integrated manner. "Operating together" refers to the determination that the five components collectively reduce, to an acceptable level, the risk of not achieving an objective.

Components are interdependent with a multitude of interrelationships and linkages among them, particularly the manner in which principles interact within and across components. Components that are present and functioning capture the inherent interdependencies and linkages among them.

Accordingly, management can demonstrate that components operate together when:

Components are present and functioning

Internal control deficiencies aggregated across components do not result in the determination that one or more major deficiencies exist

The term "internal control deficiency" refers to a shortcoming in a component or components and relevant principle(s) that reduces the likelihood of an entity achieving its objectives. An internal control deficiency or combination of deficiencies that severely reduces the likelihood that the entity can achieve its objectives is referred to as a "major deficiency." A major deficiency is a subset of internal control deficiencies and not a separate deficiency category. As such, a major deficiency is by definition also an internal control deficiency.

Management exercises judgment to assess the severity of an internal control deficiency, or combination of deficiencies, in determining whether components and relevant principles are present and functioning, and components are operating together, and ultimately in determining the effectiveness of the entity's system of internal control. Further, these judgments may vary depending on the category of objectives.