A control deficiency is not the end of the analysis. Management and auditors ask whether another control serves the same purpose. If it does, and it works well enough, the deficiency can be less severe than it first looks. If it does not, the deficiency stands. The SEC's interpretive guidance for management sets the test, and applying it takes discipline.
The test
The SEC guidance defines compensating controls as controls that serve to accomplish the objective of another control that did not function properly, helping to reduce risk to an acceptable level. It says management should evaluate the effect of compensating controls when determining whether a control deficiency or combination of deficiencies is a material weakness. And then it sets the condition that decides everything: to have a mitigating effect, the compensating control should operate at a level of precision that would prevent or detect a misstatement that could be material.
Three questions follow.
- Same objective? Does the compensating control address the same risk as the failed control, such as unauthorized disbursement or an unrecorded liability?
- Precise enough? Would it catch a misstatement big enough to matter? A review that investigates items over $500,000 does not compensate for a missing control over items that could add up to $200,000 and still be material.
- Operating? Is there evidence it operated throughout the period, performed by someone competent and independent of the failed control?
The same guidance lists the evaluation factors for a deficiency: whether there is a reasonable possibility the controls fail to prevent or detect a misstatement, and the magnitude of the potential misstatement, including the amount exposed to the deficiency and the volume of activity. It also notes that in many cases the maximum overstatement of a balance is the recorded amount, while understatements can be larger.
Case 1: bank reconciliation not reviewed
Deficiency. The monthly bank reconciliation is prepared by the staff accountant and not reviewed by anyone. Monthly disbursements run about $3 million; materiality is $1.2 million.
Candidate compensating control. The CFO reviews the cash balance on the monthly flash report and compares it with an online banking balance.
Analysis. The flash review compares totals only. A misappropriation of $120,000 in a month, repeated over a year, would exceed the $1.2 million materiality and would be hidden in outstanding checks or reconciling items and would not be revealed by comparing totals. Its precision is too coarse for the amount that aggregates to a material misstatement. It does not compensate.
Better compensating control. The CFO reviews the list of reconciling items older than 30 days each month and agrees them to subsequent clearing. That addresses the usual concealment technique and is detailed enough to detect the pattern. If it operates and evidence exists, severity may fall.
Case 2: segregation gap in vendor setup
Deficiency. The AP lead creates vendors and also enters invoices. See /us/blog/segregation-of-duties-conflict-matrix-design-and-testing.
Compensating control. The controller reviews a monthly vendor-change report showing new vendors, bank detail changes and their creators, and agrees each new vendor to a W-9 and approval.
Analysis. This is the same objective, performed by a different person, at the transaction level, so its precision is high. It qualifies if evidence shows it operated all twelve months. Evidence exists for five of twelve. For the seven months with no evidence, there is no compensating control, and the deficiency is evaluated without mitigation for that time. The control must be tested across the period of reliance.
Case 3: automated three-way match fails for a vendor group
Deficiency. An ERP configuration error let invoices for 40 vendors bypass the three-way match for six months.
Compensating control. AP supervisor review of payments over $25,000.
Analysis. Payments below $25,000 were not reviewed. If the 40 vendors' invoices were mostly below that amount, the review has no coverage of the exposed population. Test by computing how much of the exposed payment total falls below the threshold. Suppose $2.1 million of $2.6 million falls below it. The control covers about one-fifth of the exposure, so precision is inadequate. A full-population analytic by internal audit after the fact may serve as a compensating detective control if it covers the whole population and the exposure is explained.
What a compensating control is not
- A control that is already counted. If the "compensating" review is the same review the original relied on, it is not independent.
- A control that only exists in an email. Without a repeatable description and evidence, it is a one-time look.
- A control performed by the person with the conflict. The log kept by the IT manager who also migrates changes cannot compensate for the segregation gap in IT change.
- A control that operates after the financial statements are issued. Timeliness matters, because the definitions of material weakness and significant deficiency refer to misstatements not prevented or detected on a timely basis.
Document the conclusion
For each deficiency, record the compensating control considered, why it does or does not address the same objective, its precision (threshold or coverage), test results across the period and the conclusion on severity. The memo structure is covered in /us/blog/control-deficiency-aggregation-memo-sec-guidance-and-written-conclusion. The glossary entry is /us/glossary/compensating-control.
For private companies
Companies that are not SEC registrants have no management ICFR report requirement. The reasoning still applies when an auditor communicates control deficiencies or a lender asks for an assessment. Whether a deficiency rises to a significant deficiency or material weakness is a judgment of the same type, and the precision test is a sound way to support it.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Section II.B.1, Evaluation of Control Deficiencies (compensating controls, footnote 49): https://www.sec.gov/rules/interp/2007/33-8810.pdf
- SEC, 17 CFR 210.1-02(a), definitions of material weakness and significant deficiency: https://www.ecfr.gov/current/title-17/section-210.1-02
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error