While there has been a considerable amount of research regarding internal control over the past several years, scant empirical research has examined SAS No. 78's integrated five-component depiction of internal control in a government setting. In particular, to our knowledge, no study has assessed the types or frequency of weaknesses under the SAS No. 78 framework using actual internal control system findings. In this study, we examine 32 state department and agency internal control reports to assess how well the theoretical framework captures actual system weaknesses, and to determine the relative distribution of weaknesses across components of the framework.

Our results indicate that the five-component framework was able to effectively classify the 213 reported control weaknesses. Control activities had the highest proportion of identified weaknesses (i.e. around 30%) and monitoring the lowest proportion of weaknesses (i.e. around 10%).

Document Type


Publication Date


Publisher Statement

Copyright © 2004 Emerald Group Publishing. Article first published in Research in Governmental and Nonprofit Accounting, 11 (2004): 183-99.

The definitive version is available at:


Full citation:

Boyle, Edmund J., Steven M. Cooper, and Marshall A. Geiger. "An Empirical Analysis of Internal Control Weaknesses Under SAS No. 78: An Examination of State Audit Reports." Edited by Paul A. Copley. Research in Governmental and Nonprofit Accounting, 11 (2004): 183-99.