control risk and weakness


the need for controls is determined by asking whether the controls would reduce the organizations exposure to net financial loss. any situation in which the installation of controls would create potential savings is called a control risk. of course, accounting and processing controls cannot always create actual savings. when the implementation of controls would, on the average, create savings greater than their costs, then the risk is also a control weakness. thus, a control weakness is any control risk in which the excepted savings exceed the expected installation and operating cost of the control, since by definition a weakness is cost-effectively correctable. all control weakness should be corrected by implementing controls. if analysis shows that a risk cannot be corrected cost-effectively because the cost of the required procedures would exceed the potential savings, the organization should protect itself by acquiring i...