1. An assessment of the system of internal control can be undertaken at a process-level, business unit level, or enterprise-level.
2. All five components and 17 principles of the COSO internal control framework must be assessed.
3. Failures can occur, even in an effective system.