Material Weakness and Significant Deficiency

Both terms describe the severity of a control deficiency, and they sit on the same scale. A control deficiency exists when the design or the operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis. A deficiency in design means the control is missing or would not achieve the objective even if it operated perfectly. A deficiency in operation means a properly designed control was not applied as designed, or was applied by someone lacking the authority or competence to make it effective.

From there, severity determines the label. A significant deficiency is a deficiency, or a combination of deficiencies, less severe than a material weakness yet important enough to merit attention by those charged with governance. A material weakness is a deficiency, or a combination, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, on a timely basis.

Two factors set the severity and neither of them is whether something actually went wrong. The first is the likelihood that the control would fail to prevent or detect a misstatement, assessed as a reasonable possibility rather than a probability estimate. The second is the magnitude of the potential misstatement, which turns on the size of the account balances or transaction volumes exposed to the deficiency. A control failure that produced no misstatement can still be a material weakness, because the test is about what could have gone undetected. Compensating controls are considered, but only where they operate at a level of precision sufficient to prevent or detect a material misstatement, which is a higher bar than "someone else would probably have noticed."

Several circumstances are treated as strong indicators of a material weakness: identification of fraud, whether or not material, on the part of senior management; restatement of previously issued financial statements to correct a material misstatement; identification by the auditor of a material misstatement that the entity's controls would not have caught; and ineffective oversight of financial reporting and internal control by those charged with governance. The third of those is the one that surprises management most often, because the misstatement was corrected before issuance and it feels like the system worked. It worked because the auditor found it, which is the point.

Communication is required in writing to those charged with governance for both categories, and to management for significant deficiencies. Under an integrated audit of internal control, a material weakness means internal control over financial reporting is not effective, and for issuers subject to Section 404 that conclusion is disclosed publicly along with management's remediation plan.

Income tax accounting is a recurring source of both, which is why the ASC 740 literature and the deficiency literature keep meeting: the provision is complex, prepared late in the close, often by a specialist outside the normal control environment, and reviewed by people who cannot independently re-perform it.

Related terms: Internal Control Over Financial Reporting, ASC 740, Materiality, SOC 1 Report

Deficiencies concentrate where the work is manual, late, and thinly reviewed. Adopt's agents take the mechanical preparation off the critical path so the review happens with time left to do it properly. Sign up free.