At a meeting of The Presidents Forum this week on IT controls, the members talked about Costco’s recent annual report announcement of a material weakness in internal controls. Costco stated, “the weakness relates to general information technology controls in the areas of user access and program change-management over certain information technology systems that support the company’s financial reporting processes.” Even though this weakness only indirectly impacted the financial statements at Costco, the repercussions were great. This type of weakness is one that many can easily have in today’s world. The question around the table — “Is this a risk area in our businesses?” Who is in control of the changes to our IT systems, especially financial reporting systems? Is it an outsourced vendor? And, is it likely that we would detect or prevent any material errors in a timely basis? As systems become more complex, it is not only harder to stay on top of technology but, after changes are made, ensure the controls still meet the control objectives originally set.   The meeting didn’t produce a simple answer to prevent a Costco-like event but made the members more alert to the challenges of complex systems.