Question: The cost of internal control must be justified by the benefits from internal control! This is why we don't see a lot of small businesses using "segregation of duties" because of two reasons: they don't have enough employees, and the owner/manager has a reasonably good control over what is going on.

So we all agree that internal control is a systematic structure of certain practices that are established to achieve the objectives that many of you have listed above.

How has the Sarbanes-Oxley Act of 2002 (SOX) given added importance to internal control over financial reporting? Has it succeeded in its purpose? Do you have any examples of major companies where you still see problems (based on their internal control report which may be found in their annual 10-K report)?