List the control deficiencies you found, tag each to an account, and see the combined exposure by account against a threshold you set. Deficiencies that are individually small can matter together.
Deficiencies rated Remote, or where a compensating control works, are left out of the total. This is a screening aid. Whether deficiencies together are significant or a material weakness is a judgement under your framework, such as SA 265 or the guidance for internal financial controls. Check the current definitions.
One weak control may not matter much. Several weak controls over the same account or assertion can let a material error through, because a compensating control for one gap may not cover the next. Grouping deficiencies by account shows where the combined exposure builds up. Estimate exposure as the amount that could be misstated, not the amount that probably is.
Each deficiency carries an account, a potential exposure in rupees, a likelihood and a flag for a working compensating control. Remote items and items covered by a working compensating control are left out. The rest are added up by account and overall.
You set the materiality and a percentage of it as the aggregation threshold. Any account at or above the threshold, or a combined total at or above materiality, is flagged for evaluation as significant together.
The output is an indicator to support your judgement. It does not classify a deficiency as a significant deficiency or a material weakness.
Materiality ₹50,00,000 and threshold 50%, so the threshold is ₹25,00,000. Two payables deficiencies of ₹12,00,000 and ₹18,00,000 are counted. A remote bank item is not.
