Internal control is a process that is designed to provide reasonable assurance that a firm can achieve
its objectives, where differing aspects of internal control can be partitioned into operating objectives,
reporting objectives, and compliance objectives (COSO 1992). Internal control over operations is
comprised of policies, procedures, and personnel intended to enhance the effectiveness and efficiency of
firm operations and safeguard assets (COSO 2013; Lawrence, Minutti-Meza, and Vyas 2014). Internal
control over financial reporting (ICFR) encompasses the processes and procedures established by management to maintain records that accurately reflect the firm’s transactions (Deloitte & Touche, Ernst
& Young, KPMG, and PricewaterhouseCoopers 2004). The development of policies and procedures
related to effective ICFR is a strategic choice by management and boards of directors, who weigh the
costs and benefits of establishing and maintaining effective ICFR (COSO 2013), as well as the costs of
disclosing ineffective ICFR (Government Accountability Office [GAO] 2013).