Control Deficiency Aggregation Memo: SEC Guidance, Indicators and the Written Conclusion

When tests find several control deficiencies, the question is not whether each one is a material weakness. The question is whether they, individually or together, are. The SEC's interpretive guidance for management (Release No. 33-8810) says how to answer it. A deficiency evaluation memo records the answer in a form that survives review. This post sets out the framework and a worked memo.

The definitions

Under SEC rules, a material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight of financial reporting.

"Reasonable possibility" has a footnoted meaning in the guidance: the likelihood of the event is either "reasonably possible" or "probable" as those terms are used in FASB Statement No. 5, Accounting for Contingencies. The guidance adds that the evaluation can be made without quantifying the probability as a percentage or range.

What the guidance requires management to consider

Severity does not depend on whether a misstatement occurred. It depends on whether there is a reasonable possibility that controls will fail to prevent or detect a misstatement on a timely basis, and on the magnitude of the potential misstatement.

Risk factors that affect the reasonable possibility include the nature of the financial reporting elements involved (suspense accounts and related party transactions involve greater risk), susceptibility of the asset or liability to loss or fraud, subjectivity and judgment needed to determine the amount, interaction with other controls, interaction of the deficiencies, and possible future consequences.

Magnitude factors include the financial statement amounts or total transactions exposed to the deficiency, and the volume of activity in the account in the current period or expected in future periods.

Aggregation. Multiple deficiencies that affect the same financial statement amount or disclosure increase the likelihood of misstatement and may, in combination, constitute a material weakness even if each is less severe. Management should evaluate deficiencies affecting the same amount, disclosure or component of internal control together.

Compensating controls count only if they operate at a level of precision that would prevent or detect a misstatement that could be material. See /us/blog/compensating-controls-precision-and-when-they-reduce-deficiency-severity.

Indicators. Management should evaluate whether these situations indicate a deficiency exists and, if so, whether it is a material weakness: fraud by senior management, whether or not material; restatement of previously issued financial statements to correct a material misstatement; a material misstatement identified in the current period in circumstances indicating the controls would not have detected it; and ineffective oversight of external financial reporting and ICFR by the audit committee.

Prudent official test. Management should also consider the level of detail and degree of assurance that would satisfy prudent officials in the conduct of their own affairs that transactions are recorded as necessary to permit preparation of GAAP financial statements. If a deficiency might prevent prudent officials from concluding they have reasonable assurance, treat it as an indicator of a material weakness. The phrase comes from the Exchange Act's definition of reasonable assurance.

Memo structure

1. Deficiency description. Condition, process, control, period.
2. Account and assertions affected. Which financial statement amounts and disclosures.
3. Likelihood analysis. The risk factors above, with facts.
4. Magnitude analysis. Exposed amounts, activity volume, and the maximum plausible misstatement. The guidance notes that the maximum overstatement of a balance is generally its recorded amount, and understatements can be larger.
5. Compensating controls. What was considered, precision and test results.
6. Aggregation. A table of deficiencies by account or component showing combinations.
7. Indicators. Each of the four, answered yes or no with a reason.
8. Conclusion. Control deficiency, significant deficiency or material weakness, with the reasoning.
9. Reporting. Who was told and when.

Worked example

Facts for a registrant with revenue of $210 million and materiality of $2.0 million.

Aggregation. D1, D2 and D3 each affect revenue or receivables. Taken singly: D1 exposes up to $4.4 million in cutoff for two months, and the maximum overstatement of revenue is therefore substantial in relation to $2.0 million materiality; D2 exposes $3.1 million of credits to unauthorized issuance; D3 undermines the reserve on $31 million. The deficiencies interact: unapproved credits that are not captured in cutoff review and not reflected in a reserve built on an unreliable aging report all affect the same amount.

Compensating controls. The controller's monthly flux review of revenue by product investigates differences over $1 million. That threshold is higher than the credit memo irregularities that would show at the product level, so it does not compensate for D2. It partially compensates for D1 in the two months because a cutoff error of $1 million or more would be visible, but errors of $500,000 would not.

Indicators. No senior management fraud identified. No restatement. The year-end audit adjustment of $1.1 million to receivables arose from the untested aging report. It is below the $2.0 million materiality, so the third indicator is not met, but it shows D3 failing to detect a misstatement and weighs toward a more severe conclusion. Audit committee oversight is effective.

Conclusion. The three deficiencies, in combination, affect revenue and receivables with a reasonable possibility of a material misstatement not being prevented or detected on a timely basis. The combination is a material weakness. Management cannot conclude ICFR is effective. The memo then supports the disclosure described in /us/blog/material-weakness-remediation-and-disclosure-in-the-form-10-k.

Reporting path

Management must disclose material weaknesses in its annual report on ICFR under Item 308(a), and the guidance states that significant deficiencies are not required to be disclosed there. Section 302 separately requires the certifying officers to disclose significant deficiencies and material weaknesses to the auditors and the audit committee. The certifications are covered in /us/blog/sox-302-and-906-certifications-versus-section-404-reporting.

Mistakes to avoid

• Evaluating each deficiency alone and never combining.
• Stating that no misstatement occurred as a reason for a low severity rating. The guidance says severity does not depend on whether a misstatement occurred.
• Counting a compensating control without testing precision.
• Leaving the conclusion implied.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• SEC, 17 CFR 210.1-02(a), definitions of material weakness and significant deficiency: https://www.ecfr.gov/current/title-17/section-210.1-02
• SEC, Release No. 33-8810, Section II.B.1, Evaluation of Control Deficiencies (including footnotes 46 to 51): https://www.sec.gov/rules/interp/2007/33-8810.pdf
• Securities Exchange Act of 1934, section 13(b)(7), 15 U.S.C. 78m(b)(7): https://www.law.cornell.edu/uscode/text/15/78m

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error