@CPA, Trish and Ocean: The answer is A
Here's the explanation:
No matter how well internal controls may be designed and operated, they can only provide an entity with reasonable, but not absolute, assurance about achieving the entity’s objectives. Certain limitations are inherent to internal control, including the following:
1) Human judgment in decision making can be faulty.
2) Breakdowns in internal control can occur because of human failures such as simple errors or mistakes.
3) Errors may occur in the use of information produced by IT when that information is not effectively used because the individual responsible for reviewing the information does not understand its purpose or fails to take appropriate action.
4) Controls can be circumvented by collusion or inappropriate management override.
5) Management may make judgments on the nature and extent of the controls it chooses to implement and the nature and extent of the risk it chooses to assume.
.