Principle 4 (Demonstrates Commitment to Competence)

Internal control deficiency noted relating to the lack of an effective learning and development program. Management judgmentally makes a preliminary determination that Control Environment is present and functioning.

Principle 9 (Identifies and Analyzes Significant Change)

Internal control deficiency noted relating to some operations personnel not possessing the skills and competency to identify risks associated with the new technology. Based on its judgment, and considering the strength of the other principles in the component, management makes a preliminary determination that Risk Assessment is present and functioning.

Principle 12 (Deploys through Policies and Procedures)

Internal control deficiency noted relating to individuals who are not well trained. Based on its judgment, and considering the strength of the other principles in the component, management makes a preliminary determination that Control Activities is present and functioning.

Based on its judgment, management makes a preliminary determination that Information and Communication is present and functioning with no internal control deficiencies.

Principle 16 (Conducts Ongoing and/or Separate Evaluations)

Internal control deficiency noted relating to individuals who may not be knowledgeable in the new technology and underlying business processes. Based on its judgment, and considering the strength of the other principles in the component, management makes a preliminary determination that Monitoring Activities is present and functioning.

Management reviewed the internal control deficiencies across the entity to determine if the components were operating together in an integrated manner. Management noted several internal control deficiencies where competency was a contributing factor. The requirement for maintenance of the highest quality standards and the resulting low-risk tolerance for defective manufacture reveal a concern about the lack of a commensurate training and competency framework that pervades the organization. The reviewers noted that the individuals are experienced and knowledgeable, but the new manufacturing requirements requiring them to quickly adapt to changes have become difficult due to the lack of a "competency training culture." This situation has the potential of affecting the business objective of providing quality within the tolerance levels prescribed by the customer.

In this scenario, based on considerations when evaluating the components together, management concludes that a major deficiency exists and thus the system of internal controls is not effective. (Note that the templates presented show management's preliminary determination of the severity of the deficiencies. With the updated determination, management would likely change the templates to reflect that the root cause internal control deficiency that was initially not deemed major has been reclassified as major and the associated principle and component are not present and functioning.)