Jose Rodriguez was the only internal auditor of a medium-sized communications firm. The company used a computer for most of its accounting applications, and recently, several new software packages had been implemented to handle the increased volume of the company’s business. To evaluate the packages’ control capabilities, Jose performed a cost-benefit analysis and found that many of the control procedures were potentially useful but not clearly cost-effective. The problem, therefore, was what to say in his report to management. After pondering this question for some time, he decided to recommend almost all the controls based on the idea that a company was ‘‘better to be safe than sorry.’’