Audit deficiencies in internal controls are flaws in the systems a company uses to produce reliable financial statements, and auditors sort them into three tiers of severity: a plain control deficiency, a significant deficiency, or a material weakness. The tier assigned decides who has to be notified, whether investors have to be told, and whether the auditor issues an adverse opinion on the company’s controls. These findings are about the risk of future misstatements, not necessarily errors already sitting in this year’s numbers.
What a Control Deficiency Actually Is
Internal control over financial reporting (ICFR) is the set of processes a company relies on to keep its financial statements accurate and in line with GAAP. Under PCAOB standards, a deficiency exists whenever the design or the operation of a control fails to let management or employees prevent or catch a misstatement on time.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
That splits two ways. A design deficiency means a necessary control is missing entirely, or the control that exists is built in a way that could never accomplish its purpose even if performed perfectly. A company with no approval requirement for large journal entries has a design problem: the sign-off was never required, not merely skipped. Missing segregation of duties and unrestricted access to financial systems fall in the same category.
An operating deficiency is different. The control is designed correctly but doesn’t run the way it’s supposed to. The journal entry approval policy exists, but the manager signing off never reviews the supporting documentation, or the person performing the control lacks the authority to enforce it.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Operating problems are usually easier to fix because they trace back to training, staffing, or follow-through rather than a fundamental redesign.
The Three Severity Levels
Classification is what matters. The auditor assesses severity based on two things: the magnitude of the potential misstatement and the likelihood that the company’s other controls would fail to catch it.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements An actual misstatement doesn’t have to have occurred. The question is what could happen.
Control Deficiency
This is the baseline finding for any weakness that doesn’t reach one of the two higher tiers. The flaw is real but the risk of a material misstatement getting through is low. It still gets reported in writing to management so it can be addressed, but it doesn’t set off the alarms reserved for the higher levels.
Significant Deficiency
A significant deficiency is a deficiency, or a combination of them, serious enough to deserve the attention of those responsible for financial reporting oversight, but not severe enough to be a material weakness.2Public Company Accounting Oversight Board. Auditing Standard 5 – Appendix A It sits in the middle. The risk is more than trivial but not high enough to say a material misstatement is reasonably possible. These go directly to the audit committee in writing.
Material Weakness
The top tier. A material weakness means there is a reasonable possibility that a material misstatement of the company’s financial statements will not be prevented or detected in time. “Reasonable possibility” is borrowed from the accounting standards on contingencies, and it covers outcomes that are either reasonably possible or probable, meaning more than remote.2Public Company Accounting Oversight Board. Auditing Standard 5 – Appendix A That’s a lower bar than many people expect.
When a material weakness exists, the auditor must issue an adverse opinion on the effectiveness of ICFR.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements That opinion is separate from the opinion on the financial statements themselves, and a company can receive a clean opinion on its financials and an adverse opinion on its controls in the same year. The material weakness signals that the guardrails are broken even if the car has not yet gone off the road.
How Auditors Decide Which Tier Applies
Severity is a judgment, not a formula. Auditors weigh several risk factors: how susceptible the related asset or liability is to fraud, how much complexity and judgment go into the amounts at stake, how the deficient control interacts with other controls, and the possible future consequences of the flaw.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements There is no bright-line percentage test. Materiality benchmarks such as a percentage of pretax income, revenue, or total assets are common starting points, but they still require professional judgment tied to the company’s size, industry, and performance.
Aggregation catches companies off guard. Several individually minor deficiencies can combine into a material weakness when they affect the same account or disclosure. A weak review of revenue recognition, a missing accounts receivable reconciliation, and inconsistent documentation of credit memos may each look manageable on their own. Together, they create an environment where a material revenue misstatement could slip through.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
PCAOB standards also flag several situations as strong indicators that a material weakness exists:
- Any fraud involving senior management, whether or not the dollar amount is material.
- A restatement of previously issued financial statements to correct a material error.
- A material misstatement identified by the auditor that the company’s own controls should have caught.
- Ineffective oversight of financial reporting and internal control by the audit committee.
When any of these is present, the auditor has a high bar to clear before concluding the finding is anything less than a material weakness.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
Who Has to Be Told
Once deficiencies are classified, the auditor’s reporting duties depend on the tier. All control deficiencies, including the lowest tier, must be communicated in writing to management, because management is the group that has to fix them.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements The auditor also informs the audit committee that the communication to management occurred.
Significant deficiencies and material weaknesses must be communicated in writing to the audit committee, with each finding clearly labeled as one or the other. That communication has to happen before the auditor issues the audit report, not after. One rule auditors sometimes overlook: PCAOB standards prohibit the auditor from issuing a written statement saying no significant deficiencies were found during the audit, because a financial statement audit isn’t designed to surface every internal control problem.3Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
If the auditor concludes the audit committee’s own oversight is ineffective, that finding must go in writing to the full board of directors.3Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
When Investors Have to Be Told
For companies subject to the Securities Exchange Act of 1934, control deficiencies don’t stay internal. SEC regulations require every reporting company to include a management report on internal controls in its annual filing. That report must state management’s assessment of ICFR effectiveness, identify the framework used, and disclose any material weakness.4eCFR. 17 CFR 229.308 – (Item 308) Internal Control Over Financial Reporting If even one material weakness exists, management cannot conclude that ICFR is effective.
The disclosure typically appears in Form 10-K, and the external auditor’s attestation report on management’s assessment is included alongside it. The framework comes from Sarbanes-Oxley. Section 302 requires the CEO and CFO to personally certify in every annual and quarterly report that they are responsible for internal controls, that they have evaluated those controls within the past 90 days, and that they have disclosed all significant deficiencies and material weaknesses to the auditors and the audit committee, along with any fraud involving employees with a significant role in internal controls. Section 404(a) requires the annual management assessment; Section 404(b) requires the external auditor’s separate attestation.5Securities and Exchange Commission. Managements Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports
Management must also evaluate any changes to internal controls each quarter and report whether those changes materially affected ICFR.6eCFR. 17 CFR 240.13a-15 – Controls and Procedures A material weakness discovered mid-year can’t wait for the 10-K.
Smaller Companies and the 404(b) Exemption
Not every public company faces the full weight of Section 404(b). Non-accelerated filers are exempt from the auditor attestation requirement. A company generally qualifies as a non-accelerated filer if it has a public float below $75 million. Smaller reporting companies with a public float between $75 million and $250 million may also qualify as non-accelerated filers if revenues are below $100 million.7Securities and Exchange Commission. Smaller Reporting Companies They still have to perform the Section 404(a) management assessment; they just don’t need an external opinion on it.
A Note on Private Companies
Everything above applies to public companies audited under PCAOB standards. Private companies are audited under AICPA Statements on Auditing Standards and are not subject to SOX Section 404, so they do not include a management ICFR report in their financial statements. Auditors of private companies still evaluate and communicate control deficiencies, but the mandatory public disclosure framework does not apply.
Fixing a Deficiency
Finding a deficiency is the beginning. Remediation follows a predictable sequence.
Start with root cause. A control that isn’t being performed may trace back to inadequate staffing, poor training, unclear documentation, or a system that makes the control impractical to run consistently. Jumping straight to “add another review step” without understanding why the current step failed produces the same finding a year later.
Once the cause is clear, management builds a remediation plan. That usually means redesigning the control, retraining the people who perform it, or automating what was previously manual. After the new or redesigned control is in place, management has to test it over a meaningful stretch of time to show it works, ideally close to a full year. In the next audit, the external auditor re-tests the remediated control independently to confirm the deficiency is gone.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Until that re-testing is done, the material weakness or significant deficiency stays on the books.
What Happens if a Material Weakness Isn’t Fixed
Unresolved material weaknesses compound. The adverse opinion on ICFR persists year after year, eroding investor confidence. External audit fees tend to rise substantially because the auditor must do more extensive testing to compensate for the unreliable controls. And the SEC has enforcement authority over companies that fail to maintain adequate internal controls under the Exchange Act’s reporting requirements.
SEC enforcement actions in this area have produced civil penalties, requirements for independent investigations, and mandatory remediation undertakings. In some cases the SEC has imposed what amounts to a conditional fine, requiring additional payments if the company fails to complete remediation on schedule. Beyond monetary penalties, companies with persistent control failures have faced restatements, delayed filings leading to exchange delisting, and employee misconduct that went unchecked because the controls meant to catch it were not working.
Companies that treat remediation as a real priority tend to resolve these findings in a single audit cycle. Those that don’t can find themselves in a spiral of adverse opinions, regulatory attention, and steadily rising costs.