Examples of internal control failures fall into four recognizable groups: breakdowns that distort financial reporting, breakdowns that let insiders steal cash or assets, breakdowns in information technology, and breakdowns in the governance culture that is supposed to hold the other three together. More than half of all occupational fraud cases trace back to either missing internal controls or someone overriding the controls that exist.1ACFE. 2024 Report to the Nations The specific failures below, drawn from SEC complaints and documented corporate collapses, show what each category looks like in practice and what it costs when the breakdown becomes public.
How Serious Is a Control Failure?
Auditors sort control failures into three tiers, and the tier determines what has to happen next. A simple deficiency means a control is poorly designed or isn’t operating as intended but probably won’t cause a major misstatement. A significant deficiency is more serious and warrants the attention of those overseeing financial reporting. A material weakness sits at the top: there is a reasonable chance that a significant error in the financial statements won’t be caught in time.2Public Company Accounting Oversight Board. AS 2201 An Audit of Internal Control Over Financial Reporting Material weaknesses trigger mandatory public disclosure at public companies and often move the stock price. Lesser deficiencies are communicated privately to the audit committee. Every example that follows reached at least the significant deficiency threshold, and most were material weaknesses by the time they came to light.
Financial Reporting Failures
Control failures that distort financial statements usually share a common root: insufficient segregation of duties. When one person can initiate, record, and reconcile a transaction, the check that would catch an error or fraud doesn’t exist.
Revenue Recognition Schemes
Revenue is the number investors watch most closely, which is why it gets manipulated most often. Under ASC 606, a company should recognize revenue only after satisfying its performance obligations to a customer. Control failures here involve booking sales before goods ship, before the customer accepts the product, or before anything has actually happened.
Channel stuffing is the common version. A company pressures distributors into accepting more product than they can sell, then books the inflated shipments as revenue. The SEC charged Elanco Animal Health with this practice in 2024, and the company settled for $15 million. The underlying control gap: no one independent of the sales team was reviewing whether revenue recognition criteria were actually met before the journal entry posted.
Fictitious revenue is the more aggressive variant. Management creates invoices for customers who don’t exist, or records returned merchandise as a fresh sale. Without a control requiring someone to match shipping documents against recorded invoices, phantom revenue inflates the top line unchecked.
Inventory Overstatement
Inventory sits on the balance sheet as an asset, so overstating it both inflates assets and understates cost of goods sold, making profits look better than they are. The most basic failure is skipping independent physical counts. If no one walks the warehouse and compares actual stock to the perpetual records, employees can inflate quantities with little risk of detection.
Valuation failures are subtler. Accounting rules require inventory to be carried at the lower of cost or net realizable value, so when controls don’t flag obsolete, damaged, or slow-moving stock for write-down, the asset stays inflated. The correction, when it finally comes, hits earnings all at once.
Improper Capitalization of Expenses
Capitalizing a cost spreads it across years through depreciation. Expensing it hits the income statement immediately. When a company capitalizes routine operating expenses, it pushes today’s costs into the future and inflates current earnings.
WorldCom turned this single control failure into one of the largest frauds in history. Beginning in 2001, senior management directed employees to reclassify billions of dollars in ordinary line-cost expenses as capital assets, without supporting documentation and in violation of basic accounting principles. Over five quarters, the improper capitalizations totaled roughly $3.8 billion. The SEC’s complaint cited “chronic and pervasive failures to follow GAAP standards, and to mandate and institute appropriate internal controls.”3SEC. Complaint SEC v WorldCom Inc The missing control was straightforward: independent verification that expenditures met the company’s capitalization policy before being booked as assets.
Asset-Safeguarding Failures
Financial reporting failures aim to mislead outsiders. Operational control failures let insiders take money. These breakdowns involve cash and physical assets rather than accounting entries, and they tend to go undetected for long stretches because no one is looking at the right reconciliation.
Cash Skimming
Skimming is theft of cash before it ever enters the accounting system. The classic setup has the same person opening incoming mail, receiving customer payments, and recording the receipts. That person can pocket a check and never create a corresponding entry. Because the cash was never recorded, a standard financial audit won’t catch it.
Point-of-sale environments see a different version. Without sequentially numbered receipts or a system that logs every transaction automatically, an employee can accept a customer’s payment, delete the transaction, and keep the cash. The fix is straightforward in concept: total cash deposited must match total recorded sales, verified daily by someone other than the person handling the money.
Ghost Employee Payroll Fraud
A ghost employee is a fictitious person, or a former employee who still appears on the payroll and still receives paychecks. The money flows to whoever set up the scheme. These cases typically run about 18 months before anyone notices.
The control failure is almost always the same: one person can add new hires to the payroll system and approve their timecards or salary. Effective control separates those functions so the hiring manager, HR, and payroll processor are distinct people with limited system access. Add a periodic reconciliation of the active-employee list against the payroll disbursement file and ghost employees get flagged quickly. Without that reconciliation, the scheme can run indefinitely.
Procurement Fraud and Kickbacks
Procurement fraud starts when someone can create a new vendor in the system without independent verification. An employee sets up a shell company, routes purchase orders to it, and approves payment for goods or services that never arrive. Kickback schemes work similarly: a real vendor overcharges, and the employee who approves the inflated invoices gets a cut.
The primary defense is the three-way match, which requires the purchase order, the receiving report, and the vendor invoice to agree before payment is released. When a payment approver can override or ignore mismatches in that process, the door opens. Organizations lose an estimated five percent of annual revenue to fraud, and procurement schemes account for a meaningful share.
Information Technology Control Failures
IT general controls underpin everything else. If someone can alter the system that records transactions, no amount of manual oversight downstream will catch the manipulation.
User Access That’s Too Broad
Granting employees more system access than their jobs require is the digital version of a segregation-of-duties failure. A system administrator with unrestricted access can bypass application-level controls, alter records, and potentially cover the tracks. The real problem isn’t that someone has administrative privileges. It’s that no one reviews whether those privileges still match the person’s current role.
Terminated employees who retain system access are an even more dangerous gap. A former employee with active credentials can log in remotely, extract sensitive data, or plant malware. The control that catches this is a periodic access review, ideally automated, that compares user privileges against current job functions and flags terminated accounts still showing as active.
Uncontrolled Changes to Production Systems
Change management controls govern how modifications to software, databases, and operating systems move from development into the live production environment. When a programmer can push code directly to production without independent testing and formal sign-off, the risk of errors in financial calculations rises sharply. An unapproved change could alter how the system calculates tax withholdings, processes customer orders, or posts journal entries.
The fix requires strict separation between development and production. Changes are built in development, tested in staging, and approved before touching live data. The point isn’t bureaucracy. It’s the reason a single developer’s mistake at 2 a.m. doesn’t quietly corrupt three months of financial records.
Inadequate Data Backup and Recovery
When backup and recovery controls fail, the consequences can be existential. Code Spaces, a cloud hosting company, was destroyed in 2014 after attackers infiltrated its AWS control panel and deleted not only primary data but also the cross-region backups that were supposed to be the safety net. The company never recovered. TravelEx, a foreign-currency exchange operating in 30 countries, was hit by ransomware in 2020 and couldn’t restore normal operations even after paying the attackers. It effectively went out of business.
The control failures in these cases follow a pattern. Backups weren’t performed frequently enough, weren’t stored in a way that isolated them from the production environment, or were never tested to confirm they could actually be restored. A backup that can’t survive a test restoration isn’t a backup. Organizations that haven’t rehearsed recovery under realistic conditions are the ones that discover their plan doesn’t work during an actual crisis.
Governance and Control Environment Failures
Every example above describes a specific control that broke down. Controls don’t exist in isolation, though. They work only when the people at the top of the organization insist they work. A weak control environment is the root cause behind most large-scale corporate frauds because it gives silent permission for every other control to be bypassed.
Management Override
Management override is the most destructive type of failure because the people responsible for enforcing controls are the ones subverting them. Lower-level controls become meaningless when a CFO can bypass the required approval chain for a journal entry or direct subordinates to book fictitious entries.
HealthSouth shows how far this can go. Senior accounting personnel held regular meetings to decide which false entries to record so reported earnings would match Wall Street expectations. They reduced a contra-revenue account called “contractual adjustment” because the amounts booked there were estimates with limited paper trails, which made false entries harder for auditors to trace. They designed each inflation to flow through multiple intermediary journal entries specifically to obscure the manipulation, and they produced forged documents when auditors asked questions.4SEC. Complaint HealthSouth Corporation and Richard M Scrushy
Enron’s failures followed a different pattern but the same governance breakdown. A Senate oversight report found that the board approved complex related-party transactions without sufficient diligence and then failed to monitor them. The resulting accounting manipulations included roughly $7–8 billion in improperly recorded liabilities and cash flow, nearly $4 billion in undisclosed contingent liabilities, and a $1 billion reduction in shareholder equity. The external auditor, Arthur Andersen, failed to bring internal control concerns about these transactions to the board’s attention.5GovInfo. Financial Oversight of Enron The SEC and Private-Sector Watchdogs
Wirecard reinforced the pattern internationally. The German company acknowledged in 2020 that €1.9 billion in reported bank balances simply didn’t exist. Every line of defense failed: internal controls, the supervisory board, the external audit, financial reporting oversight bodies, and the market regulator BaFin.
A Weak Internal Audit Function
A strong internal audit department provides independent, ongoing evaluation of whether controls are working. That independence evaporates when the function reports to the wrong person. The Institute of Internal Auditors recommends that the Chief Audit Executive report administratively to the CEO and functionally to the audit committee, specifically so that internal audit is not positioned within an operation it might need to examine.6The Institute of Internal Auditors. Implementation Guide Standard 1110 Organizational Independence When the Chief Audit Executive reports to the CFO, internal audit becomes subordinate to a function it is supposed to scrutinize.
The structural failure deepens when audit findings are routinely ignored. If the audit committee receives reports detailing control deficiencies and takes no corrective action, the organization has effectively announced that compliance is optional. Internal audit teams that lack resources, authority, or protection from retaliation produce reports that nobody reads, which is worse than having no audit function at all because it creates a false sense of security.
Ethical Culture Breakdown
When employees see executives violate the code of conduct without consequences, they draw the obvious conclusion: the stated values are decoration. An ethical culture breaks down through inconsistent enforcement, and the damage is self-reinforcing. Employees stop reporting problems because they don’t believe anything will change, and the loss of that early-warning system allows small control failures to grow into full-scale fraud schemes.
The most tangible indicator of this breakdown is a nonfunctional whistleblower mechanism. Tips from employees are the single most effective fraud detection method, catching 43% of occupational fraud cases, more than three times the rate of any other detection method.1ACFE. 2024 Report to the Nations When employees fear retaliation for using the hotline, the organization loses its best sensor. Federal law protects whistleblowers at public companies from discharge, demotion, suspension, threats, or harassment for reporting conduct they reasonably believe violates securities laws or SEC rules. An employee who prevails in a retaliation claim is entitled to reinstatement, back pay with interest, and compensation for litigation costs and attorney fees.7Office of the Law Revision Counsel. 18 USC 1514A Civil Action to Protect Against Retaliation in Fraud Cases
What Happens Legally When Controls Fail
Internal control failures at public companies create specific legal obligations and criminal exposure under the Sarbanes-Oxley Act, which Congress passed in 2002 largely in response to the Enron and WorldCom collapses.
Under SOX Section 302, the CEO and CFO of every public company must personally certify in each quarterly and annual report that they are responsible for establishing and maintaining internal controls, that they have evaluated those controls within 90 days of the report, and that they have disclosed all significant deficiencies and material weaknesses to the auditors and audit committee. They must also disclose any fraud involving management or employees who play a significant role in internal controls, regardless of whether that fraud is material.8Office of the Law Revision Counsel. 15 USC 7241 Corporate Responsibility for Financial Reports
SOX Section 404 goes further, requiring each annual report to contain a formal management assessment of whether the company’s internal controls over financial reporting are effective. For accelerated and large accelerated filers, the external auditor must independently attest to that assessment.9Office of the Law Revision Counsel. 15 USC 7262 Management Assessment of Internal Controls A material weakness disclosed under Section 404 is public information that investors, analysts, and regulators use to evaluate the company’s reliability.
SOX Section 906 attaches criminal penalties to the certification process. A CEO or CFO who certifies a financial report knowing it doesn’t comply with SEC requirements faces up to $1 million in fines and 10 years in prison. If the false certification is willful, the penalties jump to $5 million and 20 years.10Office of the Law Revision Counsel. 18 USC 1350 Failure of Corporate Officers to Certify Financial Reports A knowing violation means the officer was aware the report was noncompliant. A willful violation means the officer deliberately certified it anyway. Both are federal crimes, and the willful version carries penalties harsh enough to end a career and a liberty.