CORAA
University · SOX and ICFR

SOX Control Deficiency Severity Evaluator.

Work through likelihood, magnitude, compensating controls and indicators to see an indicative classification: control deficiency, significant deficiency or material weakness. A guide for structuring the judgement, not a conclusion.

1. Likelihood
2. Potential magnitude of misstatement
3. Compensating controls
4. Combination
5. Indicators of a material weakness
Indicative classification
Significant deficiency
  1. Base from likelihood and magnitude: Significant deficiency.

This is an indicative guide. The classification is a judgement made against the current standard and your methodology, and needs documented rationale and review.

Three levels of severity.

A control deficiency exists when a control does not let people prevent or detect misstatements on time. A significant deficiency is less severe than a material weakness but important enough to merit the attention of those overseeing financial reporting. A material weakness is a deficiency, or combination, with a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis. “Reasonable possibility” means more than remote.

Deficiency worksheet (Word)Issue rating matrix

How deficiency severity is evaluated

Severity depends on two things: whether there is a reasonable possibility that the control failure would let a misstatement through, and how large that misstatement could be. If there is a reasonable possibility and the misstatement could be material, the deficiency points to a material weakness. If it could be important but less than material, it points to a significant deficiency.

Compensating controls can lower severity only if they operate at a sufficient level of precision and have been tested. Several deficiencies affecting the same account can add up to something more severe than each alone. Certain indicators, such as fraud by senior management, restatement of earlier statements, a material misstatement found by the auditor that controls would not have caught, and ineffective audit committee oversight, point strongly toward a material weakness.

This tool follows that logic in steps and shows its working. The result is an aid to your own documented judgement.

Worked example — manual journal entry review

Management reviews manual journal entries only occasionally. A reasonable possibility exists that an erroneous entry could pass through, and the amounts involved could be material. No other control covers it.

Inputs
LikelihoodReasonable possibility
MagnitudeCould be material
Compensating controlsNone
Output
Indicative classificationMaterial weakness
With a reasonable possibility and a potentially material effect, and nothing to compensate, the deficiency points to a material weakness. The team still documents its rationale and has it reviewed.

Common mistakes

Judging by what did happen, not what could
Severity depends on the reasonable possibility and potential size of a misstatement, not only on whether one actually occurred.
Crediting weak compensating controls
A compensating control counts only if it is precise enough to catch a material misstatement and has been tested.
Treating deficiencies one at a time
Related deficiencies over the same account can combine into a more severe one.

Frequently asked questions

What is the difference between a significant deficiency and a material weakness?+
A material weakness has a reasonable possibility of a material misstatement not being prevented or detected on time. A significant deficiency is less severe but still merits the attention of those who oversee financial reporting.
Does this tool give the final classification?+
No. It gives an indicative result from your inputs. The classification is a judgement made against the current standard and your methodology.
Does SOX apply to Indian companies?+
Only where they are subject to US securities law, for example as SEC registrants, or where they form part of a group that is. Check your own obligations.

Authoritative sources

PCAOB — AS 2201, An Audit of Internal Control Over Financial Reporting — Primary source for the definitions and evaluation factors; read the current text.
Always confirm against the latest version of the source. Regulations evolve and amendments are common.
Related calculators
Deficiency evaluation worksheet (Word) →Control test workpaper (Word) →COSO 2013 self-assessment →Issue rating matrix →
Share this tool
Last reviewed: 2026-10-17 · For informational purposes only — not professional advice.