If all five functions were performed by one person, internal control would certainly be weakened. However, the company need not be unauditable, for two reasons: First, there may be controls outside the IT function which accomplish good control. For example, users may reconcile all input and output data on a regular basis. Second, the auditor is not required to rely on internal control. He or she may take a substantive approach to the audit assuming adequate evidence is available in support of transactions and balances