Limitations of the Internal Control Systems
According to SA 400/AAS-6 Risk Assessments and Internal Controls, internal control systems can provide only reasonable, but not absolute, assurance that the objectives of internal controls are achieved because of the following inherent limitations (Ainapure& Ainapure, 2009)
Managements may attempt to keep the cost of an internal control below its expected benefits
Most internal controls are directed at usual transactions
There is a possibility of human error due to carelessness, misunderstanding, lack of knowledge etc.
There may be collusion among employees and/ or outsiders.
A person responsible for exercising an internal control may abuse that responsibility.
Procedures may become inadequate due to changes in conditions.
...