Final answer:
Management is legally responsible for establishing and maintaining an adequate system of internal control in a company. The board of directors provides oversight, while the auditing firm and outside investors contribute to corporate governance. However, management is at the heart of implementing and upholding the internal controls.
Step-by-step explanation:
Management is legally responsible for establishing and maintaining an adequate system of internal control within a company. This system is designed to safeguard the company's assets, provide reliable financial reporting, comply with laws and regulations, and effectively and efficiently conduct operations. The board of directors, elected by shareholders, serves as the first line of oversight for top executives and is essential in corporate governance. The auditing firm hired to review financial records and the outside investors, particularly those with substantial holdings, also play critical roles in corporate governance.
In the case of Lehman Brothers, these governance mechanisms failed, leading to misinformation being provided to the investors. Nonetheless, it is the management's duty to implement and uphold internal control systems. The board of directors may oversee and ensure this obligation is met, but at the core, management holds the legal responsibility.