Some principles need to be evaluated at the entity level, some at the operating unit level, and some at both levels. Management needs to make this determination based on the objective and the way the company is organized.

Internal control deficiencies noted at the entity level may or may not impact the assessment of whether internal control is effective at a lower level of the entity. Management should understand whether an entity level control is predominant or works in conjunction with the controls "at a level below the entity level" and evaluate any internal control deficiencies accordingly.