Common material weakness examples include unrestricted user access to financial reporting systems, the absence of a formal review process for complex revenue contracts, an accounting team too small or too inexperienced to handle non-routine transactions, and broken inventory cutoff procedures at period-end. Each one is a gap in internal control over financial reporting serious enough that a material misstatement in the financial statements could go undetected. The examples matter because they show what the standard actually means once you get past the definition.
What Separates a Material Weakness From a Lesser Problem
Auditing standards sort control failures into three tiers. A control deficiency is the mildest: either the control isn’t designed well enough to catch errors, or it’s designed fine but isn’t being executed properly. A significant deficiency is more serious and has to be reported to the audit committee, but it still falls below the top tier.
A material weakness is the most severe finding. It is a deficiency, or combination of deficiencies, in internal control over financial reporting where there is a reasonable possibility that a material misstatement of the company’s financial statements won’t be prevented or detected on time.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements The “reasonable possibility” bar sits lower than the phrase suggests. Under PCAOB standards it covers events that are either reasonably possible or probable, meaning the misstatement doesn’t have to have actually happened or even be likely. The gap by itself is enough.
That is why the examples below all describe control gaps rather than accounting errors. The question isn’t whether the numbers came out wrong. The question is whether the company had a control that would reliably catch them if they did.
Four Material Weakness Examples in Practice
Unrestricted Access to Financial Systems
One of the most frequently reported material weaknesses involves the failure to control who can access and modify data inside financial systems. Picture a company where software developers hold administrative access to the production environment housing the general ledger. Nobody monitors what they do there, and no separate approval is needed before a change takes effect.
The problem isn’t that a developer committed fraud. It’s that the company has no preventive control stopping unauthorized changes to financial records and no detective control to spot them after the fact. That absence creates a reasonable possibility of undetected misstatement, which is the whole test. Remediation usually looks like role-based access, periodic access reviews, and logging that flags unusual activity.
Weaknesses tied to system access and segregation of duties have trended upward in recent years, making them one of the most commonly disclosed categories.
No Formal Review of Complex Revenue Contracts
Revenue is the line investors watch most closely, and it’s where judgment calls create the most room for error. A material weakness arises when a company has no formal, documented process for reviewing multi-element sales contracts. Without a structured review, the accounting team may miss separate performance obligations inside a contract, or allocate the transaction price incorrectly among them.
The result shows up as revenue booked in the wrong period or the wrong amount. A software company that bundles licenses, implementation services, and ongoing support in a single contract needs a systematic way to break those pieces apart. When the only process is the controller reading each contract and using judgment, the control environment has a hole big enough for a restatement to fit through.
Not Enough Accounting Expertise for the Work
This one shows up frequently at smaller public companies and at organizations that have recently gone through mergers or adopted new accounting standards. A finance team of three people may not include anyone with deep expertise in derivatives, business combinations, or stock-based compensation. It gets worse when management leans on the external auditor to find errors instead of catching them internally.
The weakness here is structural. Management cannot reliably assess whether complex GAAP requirements are being applied correctly to the financial statements. The fix usually involves hiring specialized personnel, engaging outside technical accounting consultants, or both. Companies going through rapid growth are especially exposed, because the complexity of their transactions outpaces the capabilities of a lean accounting department.
Broken Inventory Cutoff at Period-End
A material weakness in the inventory cycle often involves a breakdown in period-end cutoff, where goods, revenue, and cost of goods sold aren’t all recorded in the same period. A shipment that leaves the warehouse on the last day of the quarter but stays on the inventory books until the following month overstates ending inventory and distorts cost of goods sold.
The missing control is usually straightforward: a reconciliation between shipping records and inventory records at period-end, performed by someone independent of the warehouse and reviewed for discrepancies. When that reconciliation doesn’t happen, or happens but nobody follows up on what it turns up, small cutoff errors accumulate into a material amount.
Where These Failures Tend to Cluster
Material weaknesses tend to gather in four categories, and recognizing the categories helps you spot the pattern in a disclosure you haven’t seen before.
Entity-Level Controls
These set the tone for the whole organization: governance, the risk assessment process, and the overall control environment. When they fail, the damage rarely stays confined to one account or cycle. A board that doesn’t provide adequate oversight, or a management team that treats compliance as an afterthought, creates conditions where problems multiply. The staffing example above is an entity-level weakness.
Information Technology General Controls
IT general controls underpin every automated financial process. They cover user access security, program change management, and the integrity of data processing. When they fail, the reliability of every system touching financial data comes into question. The system access example is the classic ITGC weakness.
Business Process Controls
These are the detailed, transaction-level controls governing cycles like revenue, inventory, accounts payable, and treasury. A breakdown here goes straight into the general ledger. Unlike entity-level failures, process-level weaknesses are often traceable to a single missing step, such as an unsigned reconciliation or an unenforced approval threshold. The inventory cutoff example lives here.
Accounting and Financial Reporting Expertise
Complex accounting standards demand specialized knowledge. When a finance team lacks the technical depth to handle topics like revenue recognition under ASC 606 or lease accounting under ASC 842, even well-designed controls can fail because no one recognizes that the guidance is being applied incorrectly. The revenue contract example straddles this category and business process controls.
What Happens Once a Material Weakness Is Disclosed
The examples above only matter because of what they trigger. If even one material weakness exists at fiscal year-end, management cannot conclude that internal controls are effective, and that conclusion has to appear in the annual report on Form 10-K.2eCFR. 17 CFR 229.308 – (Item 308) Internal Control Over Financial Reporting For accelerated and large accelerated filers, the external auditor must also attest to the effectiveness of internal control, and PCAOB standards require an adverse opinion when a material weakness exists, not merely a qualified one.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Smaller reporting companies that qualify as non-accelerated filers still have to do the management assessment, but they’re exempt from the auditor attestation.
Disclosure doesn’t wait for the annual report. SEC rules require management to evaluate changes in internal controls each fiscal quarter and disclose material changes in both quarterly and annual filings.3eCFR. 17 CFR 240.13a-15 – Controls and Procedures A weakness found mid-year surfaces in the next Form 10-Q.4U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Disclosure in Exchange Act Periodic Reports Frequently Asked Questions Auditors are separately required to communicate all material weaknesses to the audit committee in writing.5Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
The market consequences are real. A material weakness often surfaces alongside, or just before, a restatement of prior financial statements. In early 2026, Driven Brands Holdings disclosed material weaknesses and announced it would restate financials covering multiple fiscal years; its stock dropped nearly 40% on the day, and a securities fraud class action followed within weeks. Research examining material weakness disclosures over a multi-year window has found that even when the announcement-day reaction looks modest, companies tend to experience substantial negative drift over the following two quarters, with annualized underperformance in the range of 10 to 16 percent. Companies also face increased SEC scrutiny, higher audit fees as the auditor expands testing, and tougher terms from lenders and investors who read an adverse opinion on internal controls as a red flag.
Remediation isn’t fast. New or redesigned controls have to be implemented and then operate effectively over a testing period before the weakness is considered resolved, and entity-level or period-end controls typically can’t be tested until at least one full close cycle has run.6Public Company Accounting Oversight Board. AS 6115 – Reporting on Whether a Previously Reported Material Weakness Continues to Exist Roughly a third of companies that report a material weakness in one year report one again in a later year, which is why the examples above keep appearing on the same list.