Although the organization may rely on an outsourced service provider to conduct business processes, policies, and procedures on behalf of the entity, management retains ultimate responsibility for meeting the requirements for an effective system of internal control.

Management's assessment of the effectiveness of internal control occurs within the entity's system of internal control. Other parties interacting with the entity, such as external auditors and regulators, are not part of the entity's system of internal control and thus cannot be part of management's process for assessing effective internal control.