How do you categorize a control weakness? Is it a material weakness, a significant deficiency or something less? This seems to be the greatest struggle in addressing internal control issues.
Below we will answer this sometimes puzzling question, but first let’s take a look at how control weaknesses are defined.
Definitions on Control Weaknesses
- Material weakness. A deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis.
- Significant deficiency. A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance.
- Other deficiencies. For purposes of this blog post, we’ll define other deficiencies as any control deficiencies that are not material weaknesses or significant deficiencies.
How to Categorize a Control Weaknesses
First ask these two questions:
- Is there a reasonable possibility that a misstatement could occur?
- Could the misstatement be material?
If your answer to both questions is “yes”, then the client has a material weakness. (By the way, if you propose a material adjustment, it’s difficult to argue that there is no material weakness. As you write your control letter, consider examining your proposed audit entries for congruence.)
If your answer to either of the questions is “no”, then ask the following:
Is the weakness important enough to merit the attention of those charged with governance? In other words, are there board members who would see the weakness as important.
If the answer is “yes”, then it is a significant deficiency.
If the answer is “no”, then the weakness is an other deficiency.
Communicating Control Deficiencies
The following deficiencies must be communicated in writing to management and to those charged with governance:
- Material weaknesses
- Significant deficiencies
The written communication must include:
- the definition of the term material weakness and, when relevant, the definition of the term significant deficiency
- a description of the significant deficiencies and material weaknesses and an explanation of their potential effects
- sufficient information to enable those charged with governance and management to understand the context of the communication
- that the audit included consideration of internal control over financial reporting in order to design audit procedures that are appropriate in the circumstances and that the audit was not for the purpose of expressing an opinion on the effectiveness of internal control
- that the auditor is not expressing an opinion on the effectiveness of internal control
- that the auditor’s consideration of internal control was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies, and therefore, material weaknesses or significant deficiencies may exist that were not identified
- an appropriate alert, in accordance with section 905, Alert That Restricts the Use of the Auditor’s Written Communication
Other deficiencies can be communicated in writing or orally and need only be communicated to management (and not to those charged with governance). The communication must be documented in the audit file. So if you communicate orally, then follow up with a memo to the file addressing who you spoke with, what you discussed, and the date the discussion occurred.
Stand-alone management letters are often used to communicate other deficiencies. Since there is no authoritative guidance for management letters, you may word them as you wish. Also, you may, if you like, include other deficiencies in your written communication of significant deficiencies or material weaknesses.
Here’s a slide deck summarizing control weakness issues. Feel free to use it to teach a class about this topic.
Learn from the CPA Scribo newsletter!
Get my free weekly accounting and auditing digest with the latest content.