Audit

Internal Control Deficiencies vs Significant Deficiencies vs Material Weaknesses

Amy Richards | | 4 min read

Quick answer: A deficiency is a shortcoming in internal control. A significant deficiency is more severe but not material. A material weakness is severe enough that there is a reasonable possibility a material misstatement will not be prevented or detected — requiring disclosure in the audit report.

Deficiency Classification Under AS 1305

Under AS 1305 (Communications About Deficiencies in Internal Control), the auditor classifies control deficiencies as follows:

  • Deficiency: A shortcoming in the design or operation of an internal control that does not allow for prevention or timely detection of misstatements
  • Significant deficiency: A deficiency, or combination of deficiencies, that is less severe than a material weakness but warrants attention by those charged with governance
  • Material weakness: A deficiency or combination of deficiencies such that there is a reasonable possibility that a material misstatement in the financial statements will not be prevented or detected on a timely basis

Indicators of Deficiencies

Auditors look for:

  • Over-reliance on detective controls without preventive controls
  • Reconciliations not performed or not reviewed
  • Segregation of duties violations (same person authorizes and records transactions)
  • Inadequate IT access controls
  • Management override of controls

Material Weakness Examples

  • Complete absence of segregation of duties in the accounting department
  • CEO with ability to post journal entries without secondary approval
  • IT general controls that allow unauthorized access to the financial reporting system
  • Inadequate controls over revenue recognition in a company with complex revenue streams

Communication Requirements

Under AS 1305, the auditor must:

  • Communicate significant deficiencies in writing to those charged with governance
  • Communicate material weaknesses in writing to those charged with governance AND in the audit report (as an explanatory paragraph)
  • Significant deficiencies may be communicated orally if they are effectively communicated in writing within the management letter

Internal links (related)

Author

Amy is a Certified Public Accountant (CPA), having worked in the accounting industry for 14 years. She is a seasoned finance executive having held various positions both in public accounting and most recently as the Chief Financial Officer of a large manufacturing company based out of Michigan.