Policies Are Not Internal Control

Why Written Rules Do Not Protect Institutions When Controls Are Weak, Untested, or Ignored in Practice