Abstract: A computer-based system and method for evaluating effectiveness of internal controls of an entity's financial statement, the method utilizing a set of evaluation criteria and a hierarchical structure comprising at least a top level, an intermediate level, and a component level. The top level comprises items corresponding to items in the financial statement, the intermediate level comprises one or more sub-items corresponding to each item of the top level, and the component level comprises one or more components corresponding to each sub-item of the intermediate level. One or more risks are defined for each component, and ratings for each risk and each component are determined against at least a portion of the evaluation criteria. The ratings from the component level are consolidated to generate proposed ratings at the intermediate level, and the ratings from the intermediate level are consolidated to generate proposed ratings at the top level.