The definitions are short. A material weakness is a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is less severe than that but important enough to merit the attention of those charged with governance. The hard part is the application. The six cases below show the reasoning in sequence. All figures are illustrative.
The evaluation sequence
For each deficiency, run the same steps and write them in the workpaper.
- Describe the deficiency. What control is missing or failing?
- Identify the exposed accounts and assertions. Which line items could be misstated?
- Estimate likelihood. Is a misstatement reasonably possible?
- Estimate magnitude. What is the maximum plausible misstatement compared to materiality?
- Look for compensating controls. Does another control operate precisely enough to catch the same error, and did you test it?
- Consider combination. Do several deficiencies affect the same account and compound?
- Classify. Record the conclusion and the reason. If the conclusion is that the matter is not a material weakness, ask whether prudent officials with the same facts would reach the same conclusion.
Severity depends on the potential for misstatement, not on whether a misstatement occurred. This post is the auditor-side view with small-client fact patterns. For the management-side evaluation, aggregation across deficiencies and the written aggregation memo, see control deficiency aggregation memo. See how to draft the written communication for what follows classification.
Assume overall materiality is $250,000 for the examples that follow.
Case 1: Bookkeeper reconciles the bank account she also deposits to
Cash receipts run about $6 million. One person handles receipts and reconciliation. The owner reviews the monthly bank statement summary and compares cash to a budget.
- Exposure: cash and revenue, existence and completeness.
- Likelihood: reasonably possible, since there is no independent check on deposits.
- Magnitude: larger than materiality if theft ran unnoticed for a year.
- Compensating control: the owner's review of the monthly statement has been tested for three months and operated, but it does not examine deposit detail.
Conclusion: significant deficiency. The owner review limits the exposure but does not eliminate it. If the owner's review did not exist or was not tested, the exposure combined with the fraud susceptibility of cash would point to a material weakness.
Case 2: No review of journal entries
The controller posts manual entries, including top-side entries at year end, with no approval. Fieldwork finds three entries totalling $310,000 that were posted without support and later reversed.
- Exposure: all accounts touched by manual entries.
- Likelihood: occurred, which is strong evidence of reasonable possibility.
- Magnitude: the entries exceeded materiality.
- Compensating control: none identified.
Conclusion: material weakness. Unsupported manual entries above materiality combined with no review control is the standard fact pattern. It is also a management override indicator.
Case 3: Client relies on the auditor to draft the financial statements and notes
The client posts transactions but cannot prepare the statements or the disclosures. The auditor drafts them each year.
This is a deficiency in the financial reporting process. Whether it is a significant deficiency or a material weakness depends on what the client controls produce on their own. The auditor asks: if the auditor did not draft the statements, would the client's controls prevent or detect a material misstatement in the statements or the notes? When the answer is no, the file needs a documented conclusion, and the weight rises if the auditor also proposed material adjustments. That is a judgment on the facts, not a rule: a client with a strong review of auditor-drafted statements can land lower than one that signs without reading. It also creates a nonattest services independence question. See independence and nonattest services.
Case 4: Inventory counts are not reconciled to the general ledger
A retailer counts inventory at year end and posts an adjustment to the ledger without a reconciliation review. Inventory is $1.4 million. Fieldwork finds a $62,000 count adjustment that had no supporting recount.
- Exposure: inventory existence and valuation.
- Likelihood: reasonably possible.
- Magnitude: $62,000 is below materiality, but the potential population of unreconciled differences is larger.
- Compensating control: perpetual records exist but are only roughly accurate.
Conclusion: significant deficiency. The auditor expanded testing and the observed error was a quarter of materiality. If the unreconciled difference had been $180,000 against a $250,000 materiality, the potential misstatement and the lack of any compensating control would move the case toward a material weakness.
Case 5: A single deficiency that is small and one that compounds
Two deficiencies at a nonprofit: the executive director approves her own expense reimbursements, and the treasurer does not review the credit card statements. Individually, each is a deficiency below significant. Together, over $400,000 of annual discretionary spending has no independent review, and the board does not request the reports.
The combination matters. The auditor evaluates them together because they affect the same accounts and the same fraud risk. Conclusion: significant deficiency in combination, with weak board oversight noted as an aggravating factor. Ineffective oversight by those charged with governance is an indicator of a material weakness, so the file records why the oversight failure was or was not severe enough.
Case 6: Auditor finds a material misstatement the controls missed
Fieldwork discovers $430,000 of unrecorded accrued liabilities at year end. Management's close process had no cutoff review. This is a standing indicator of a material weakness: a material misstatement found by the auditor in circumstances that indicate the entity's controls would not have caught it. Without a convincing compensating control, the classification is material weakness, even if management then books the entry.
Summary table
| Case | Likelihood | Magnitude vs $250,000 | Compensating control tested | Classification |
|---|---|---|---|---|
| 1 Bank reconciliation | Reasonably possible | Above | Partial, tested | Significant deficiency |
| 2 Manual entries unreviewed | Occurred | Above | None | Material weakness |
| 3 Auditor drafts statements | Reasonably possible | Pervasive | None | Significant deficiency or material weakness |
| 4 Inventory adjustments | Reasonably possible | Below, could be above | Weak | Significant deficiency |
| 5 Combined nonprofit | Reasonably possible | Above in aggregate | None | Significant deficiency |
| 6 Unrecorded liabilities | Occurred | Above | None | Material weakness |
Writing the conclusion
State the classification and the one sentence that supports it. A bare label cannot be reviewed. A reviewer should read your workpaper and reach the same classification from the facts you recorded.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement; AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, section 580 on evaluating and communicating control deficiencies: gao.gov
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error