Which of the following statements about the five components of internal control is INCORRECT?

• A. Control environment refers to the overall attitude, awareness, and actions of management regarding the internal control system.
• B. Control activities are only concerned with the segregation of duties and do not include policies or procedures.
• C. Information and communication ensure that relevant information is identified, captured, and communicated in a timely manner.
• D. Risk assessment involves identifying and analyzing risks that may prevent the achievement of organizational objectives.

Answer: (B)

Verified step by step guidance

1. Step 1: Understand the five components of internal control as defined by the COSO framework. These components are: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring.
2. Step 2: Analyze the statement about the 'Control Environment.' It refers to the overall attitude, awareness, and actions of management regarding the internal control system. This statement is correct as it aligns with the definition of the control environment.
3. Step 3: Evaluate the statement about 'Control Activities.' Control activities include policies, procedures, and practices that ensure management directives are carried out. They are not limited to segregation of duties. This statement is incorrect because it misrepresents the scope of control activities.
4. Step 4: Review the statement about 'Information and Communication.' This component ensures that relevant information is identified, captured, and communicated in a timely manner. This statement is correct as it aligns with the purpose of this component.
5. Step 5: Assess the statement about 'Risk Assessment.' Risk assessment involves identifying and analyzing risks that may prevent the achievement of organizational objectives. This statement is correct as it accurately describes the risk assessment process.