Every control gap starts as a control deficiency. It becomes a significant deficiency or a material weakness depending on how likely it is to lead to a misstatement and how large that misstatement could be. The label matters because a material weakness stops management concluding that internal control over financial reporting (ICFR) is effective.
Last reviewed: 17 October 2026. Facts checked. This guide follows the definitions and evaluation structure in PCAOB Auditing Standard 2201 and the SEC's rules, as described in secondary summaries. Those are primary documents that were not opened for this guide, so confirm the exact wording of the definitions in the current text. No quantitative thresholds are given, because the standards do not set fixed numbers and any number would be a company's own judgement.
The three levels
Control deficiency. A deficiency exists when the design or operation of a control does not let people, in their normal jobs, prevent or detect misstatements on a timely basis. It can be a missing control, a badly designed one or one that did not operate.
Significant deficiency. A deficiency, or a combination, that is less severe than a material weakness but important enough to merit attention from those responsible for oversight of financial reporting, in practice the audit committee.
Material weakness. A deficiency, or a combination, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. "Reasonable possibility" means the chance is more than remote.
The two questions that decide severity
Classification does not depend on whether a misstatement actually happened. It depends on two things:
- Likelihood. Is there a reasonable possibility that the control failure could lead to a misstatement?
- Magnitude. If it did, could the misstatement be material, taking into account amounts that could be exposed, not only amounts already seen?
A control can have failed without any error reaching the books. It can still be a material weakness if the potential error is large and the likelihood is not remote.
A step-by-step evaluation
- Describe the deficiency. What failed, when, and for how long?
- Identify the accounts and assertions affected. Which line items could be wrong?
- Look at compensating controls. Is there another control that would catch the error? It must be precise enough and tested.
- Assess likelihood and magnitude. Consider the volume of transactions, the complexity and judgement, and the size of balances exposed.
- Aggregate related deficiencies. Several smaller gaps affecting the same account or assertion may add up to a more serious problem.
- Check the risk indicators. Any of these points toward a higher rating: fraud by senior management, restatement of previously issued statements, the auditor finding a material misstatement that the company's controls missed, and ineffective audit committee oversight. Per AS 2201, these are indicators that a material weakness exists.
- Document the conclusion and who signed it off.
Worked examples (illustrative)
| Situation | Likely evaluation |
|---|---|
| One bank reconciliation signed two days late; reviewed and no errors found | Control deficiency, probably minor |
| Monthly journal entry approval not performed for any manual entries in the year; no other review of manual entries | Possible material weakness if manual entries could be material; look at compensating controls |
| Access review not performed for the ERP, but strong detective review of the key balances by the controller | Deficiency or significant deficiency depending on how strong and precise the detective control is |
| The company restated prior-year revenue because of a cut-off error the controls did not catch | Strong indicator of a material weakness |
| Several small gaps in revenue: late credit note approval, a missing review of price changes, weak shipping cut-off check | Aggregate; may together be a significant deficiency or a material weakness |
These are teaching examples, not rulings. A real conclusion needs the facts and professional judgement.
What happens after classification
| Level | Typical consequence |
|---|---|
| Control deficiency | Report to management; fix in the normal course |
| Significant deficiency | Communicate to the audit committee; track fixes |
| Material weakness | Management cannot conclude ICFR is effective; disclosure is required; the auditor (if attesting) issues an adverse ICFR opinion; remediation must be planned and tested |
Remediation is only complete when the new control has operated long enough to be tested. Ask the auditor how much operation they need to see before concluding it is fixed.
Who decides
Management decides how to classify for its own report. The auditor evaluates independently. If they disagree, the auditor's view affects the auditor's opinion, and the disagreement itself is worth escalating to the audit committee early. The audit committee should hear about significant deficiencies and material weaknesses, and the 302 certifications also require them to be reported to the committee and auditors. See SOX 302 vs 404.
Frequently Asked Questions
Can a deficiency be a material weakness if no misstatement occurred?
Yes. The test is whether there is a reasonable possibility of a material misstatement not being prevented or detected, not whether one actually occurred.
Do compensating controls always reduce severity?
Only if they operate at a level of precision that would prevent or detect a material misstatement, and have been tested.
Is a significant deficiency reported to the public?
Under SOX, material weaknesses are disclosed in the ICFR assessment. Significant deficiencies go to the audit committee and the auditor. Confirm current disclosure rules for the company.
How does this compare with India's rules?
Indian auditors report on internal financial controls under section 143(3)(i) and use their own guidance for evaluating gaps. See SOX vs IFC in India.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error