The material weaknesses identified related to transaction-level control activities leads management to determine that the Control Activities and Risk Assessment components are not present and functioning and the system of internal control is ineffective. Material weaknesses were identified, though there were no known actual material misstatements of the financial statements.

Management should determine the root cause of the material weaknesses by considering which control activity principles were not present and functioning. The points of focus can assist in this determination. For example, in this scenario, adequate control activities were never selected and deployed within the process in the first place because the risk assessment process did not identify the material change in Division C and the process to determine the relevant business processes under Principle 10 did not work appropriately.

As COSO is an integrated Framework, there are likely contributing factors to a material weakness in a particular component. In this scenario at least one of the contributing factors was a breakdown in the risk assessment process that missed that the revenue in Division C had become material in the current fiscal year. This is reflected in the related material weakness identified in Principle 9.

To have an effective system of internal control under the Framework, management needs to correct the specific material weaknesses by selecting and developing adequate control activities for the revenue process at this division, and remediate any of the internal control deficiencies that led or contributed to the material weakness, namely the issues of identifying relevant business processes in Principle 10 and the risk assessment issues in Principle 9.