Which of the following statements is true regarding internal controls?

Entity-level controls set the tone and establish the framework for the overall control environment within an organization. If these controls are poorly designed or deficient, they can undermine the effectiveness of process-level controls, even if those controls are well-designed. Entity-level controls include governance, risk management, and compliance controls that influence the entire organization. Therefore, deficiencies at this level can have a widespread impact, preventing lower-level controls from functioning properly.

Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2130 – Control.