Because of the inherent limitations of any internal control framework and underlying data, it is possible that undetectable data manipulation or system non-compliance errors may occur and not be detected during the verification engagement.