SOX Deficiency Evaluation: Aggregation, Compensating Controls and the Written Conclusion

Finding that a control failed is the easy part. The harder work is the evaluation that follows: how likely is a misstatement, how large could it be, do other deficiencies stack with it, and does anything else catch the problem? That reasoning, written down, is the document an external auditor and an audit committee will actually read.

Last reviewed: 17 October 2026. Facts checked. We opened web search results on PCAOB AS 2201 that included the PCAOB page listing and secondary summaries. These support the three severity levels, the likelihood and magnitude test, the role of compensating controls and a list of indicators of material weakness. We did not open the full PCAOB text; one summary mentions amendments to paragraph .09 and a new paragraph .99 effective 15 December 2026, which we could not verify. No quantitative thresholds are given because we could not source them. The case is invented.

Where this fits

The basic classification (deficiency, significant deficiency, material weakness) is covered in our guide to classifying control deficiencies, and fixing and retesting in SOX remediation. This post is about the middle step: the evaluation memo.

The three questions in every evaluation

The framework asks two things about each deficiency and one about the set.

1. Likelihood. Is there a reasonable possibility that the control failure could lead to a misstatement that would not be prevented or detected on time? "Reasonable possibility" is a judgement, not a probability. The question is about what could happen, not only what did.
2. Magnitude. If it did happen, how large could the misstatement be? This is bounded by the exposure of the account or transaction flow, not by the amount actually found in testing.
3. Aggregation. Do other deficiencies affect the same account, assertion or component of control, so that together they are more severe than any one alone?

Note that severity does not depend on whether a misstatement actually occurred. A control that could have let a large error through is serious even if testing found nothing wrong.

Step 1: describe the deficiency precisely

A vague description produces a vague evaluation. State:

• the control and the risk it addresses;
• whether it is a design gap or an operating failure;
• the period affected, and when it was discovered and fixed;
• the cause, such as turnover, a system change or an unclear owner;
• the accounts and assertions exposed.

Step 2: estimate the exposure

Identify the population the failed control covers: the transactions that passed through it, the balance it supports. Magnitude depends on the potential misstatement from that population, which could be bigger than the exception found in a sample. Then compare against the materiality used for assessment; see our post on SOX materiality and thresholds.

Do not extrapolate a sample error into a conclusion without thought. The sample shows that a failure exists, not its full extent. If you can, look at the whole population for the period to measure actual impact, and record that too.

Step 3: consider compensating controls

A compensating control is a different control that operates at a level of precision that would catch the same misstatement. The conditions:

• It covers the same risk and assertion.
• It operates effectively, which means it has been tested, not assumed.
• It is precise enough to detect a misstatement of the relevant size. A high-level monthly variance review rarely detects a small but material error in one account.
• It does not itself depend on the failed control or on the same person.

A frequent error is naming a review control as compensating without establishing that it is precise. Our post on management review controls describes what evidence of precision looks like. If the compensating control has not been tested, test it before relying on it, and record the results.

Step 4: aggregate

Aggregation is where isolated findings turn into a larger problem. Group deficiencies by:

• the same significant account or disclosure;
• the same assertion, such as completeness of revenue;
• the same process or the same control owner;
• the same entity-level theme, such as weak oversight, high turnover or a poor tone from the top.

Ask whether the combined potential misstatement is larger than either alone, and whether the combination is reasonably possible. Five minor deficiencies in different processes may remain minor. Three deficiencies that all weaken revenue cut-off are one story.

Step 5: look at the indicators

The standard lists indicators that point to a material weakness. From the sources we could open, these include fraud by senior management, a restatement of previously issued financial statements to correct a material error, identification by the auditor of a material misstatement that the company's controls would not have caught, and ineffective oversight by the audit committee. Confirm the exact list in the standard. If an indicator is present, the evaluation needs a strong reason to conclude anything less than a material weakness.

Step 6: write the conclusion

The memo should end with a clear classification and the reasoning chain. A reader should be able to follow:

1. What failed and what it covered.
2. The potential misstatement and why.
3. Whether compensating controls reduce it, with evidence.
4. Aggregation with other deficiencies.
5. Indicators considered.
6. Classification: deficiency, significant deficiency or material weakness.
7. Who reviewed it and approved it, and when it was reported to the audit committee.

Where judgement could go either way, say so and show why you came down where you did. Reviewers generally trust a transparent close call more than a confident one with no reasoning.

A worked example (invented)

A company finds that for four months, journal entries to the revenue account were posted by two users without the required second approval because a workflow setting was disabled after a system patch. Testing a sample of entries in that window found no errors, and the setting was restored in month five.

The evaluation: the control addresses the risk of unauthorised or incorrect revenue journals, an area with fraud risk. Magnitude is tied to all manual revenue journals in the four months, which the team lists in full. The compensating control, a monthly analytic review of revenue, is considered but found to operate at a level too high to detect individual entries of the likely size, so the team does not rely on it. Aggregation: a separate finding in the same year concerns weak review of revenue cut-off. Combined, both affect the same account and assertion area.

The team classifies the pair as a significant deficiency at minimum, and escalates the question of material weakness to the audit committee with the supporting memo. Numbers and facts are invented; the example shows the reasoning, not a ruling.

Practical tips

• Draft the evaluation before remediation is complete. How a fix made before the assessment date affects the year-end conclusion depends on whether the remediated control has operated long enough to be tested; confirm the rule with the standard and the external auditor.
• Agree the format with the external auditor early. They will do their own evaluation, and disagreement is cheaper to resolve in October than in February.
• Keep a deficiency register with a link to each memo.

The takeaway

An evaluation memo turns a finding into a decision. Be precise about what failed, measure exposure on the whole population, test compensating controls before using them, aggregate honestly and write the conclusion so a stranger could follow it.

Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error