B. Sound personnel practices contribute to sound control systems. Organizations with effective control environments transmit guidance to their employees both verbally and by example, communicating theentity's values, standards and code of conduct; and they follow up on violations. There are mechanisms to encourage employee reporting of suspected violations, and disciplinary actions are taken when employees fail to report them. Formal and clearly communicated policies and procedures that result in shared values and teamwork are followed at all times, without exception. The competence level needed for particular jobs is specified, competent people are hired and retained, and authority and responsibility are appropriately assigned.Internal control is an explicit or implicit part of everyone's job description, and all individuals in the organization realize that they will be held accountable.

C. Separation of responsibilities for the recording, custodial, and authorization functions is an essential element of a sound preventive control system, because without such separation of responsibilities, a person could commit a fraud and conceal it.

D. Implementation of state-of-the-art software and hardware is not necessary for an organization to have a sound control system.