Under the control environment component of internal control, management should

The control environment is the foundation for an effective internal control system, providing discipline and structure. A critical principle within this component is management's responsibility to establish the "tone at the top." This involves demonstrating and enforcing a commitment to integrity and ethical values throughout the organization. This commitment influences the design, implementation, and operation of all other internal control components and is fundamental to building a culture that supports the achievement of the entity's objectives.

B. implement control activities through policies. This describes the Control Activities component, which are the actions established by policies and procedures to mitigate risks, not the overarching Control Environment.

C. communicate quality information to achieve the entity's objectives. This is a core part of the Information and Communication component, which focuses on the flow of relevant and quality information internally and externally.

D. establish and operate activities to monitor the internal control system. This defines the Monitoring Activities component, which involves ongoing evaluations to ascertain whether internal controls are present and functioning effectively.

1. U.S. Government Accountability Office (GAO). (2014). Standards for Internal Control in the Federal Government (GAO-14-704G, "Green Book").

Page 34, OV2.03: "The five components of internal control are control environment, risk assessment, control activities, information and communication, and monitoring."

Page 39, Principle 1: "The oversight body and management should demonstrate a commitment to integrity and ethical values." This is the first principle listed under the Control Environment component.

Page 67, Principle 10: "Management should design control activities..." (Relates to option B).

Page 79, Principle 13: "Management should use quality information to achieve the entity’s objectives." (Relates to option C).

Page 87, Principle 16: "Management should establish and operate monitoring activities..." (Relates to option D).

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control — Integrated Framework: Executive Summary.

Page 4: "Control Environment - The set of standards, processes, and structures that provide the basis for carrying out internal control... Principle 1: The organization demonstrates a commitment to integrity and ethical values." This directly supports the correct answer. The other options are described as separate components on the same page.