Definition
A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their functions, to prevent, or detect and correct, misstatements on a timely basis. A design deficiency is a missing or inadequate control. An operating deficiency is a well-designed control that is not working as intended.
Why it matters in an audit or review
Every deficiency the auditor identifies is evaluated for severity under AU-C 265. If it is a significant deficiency or material weakness, written communication is required. Other deficiencies of enough importance to merit management's attention must also be communicated to management, orally or in writing, and many firms list them in a management letter. Evaluating severity includes asking whether compensating controls reduce the risk.
Example
The auditor tests 25 vendor payments for approval evidence and finds two with no approver sign-off. The control is designed properly, so this is an operating deficiency. The auditor checks whether other controls (a monthly budget-to-actual review) would catch an unauthorized payment, extends the sample, and concludes the deficiency is not a significant deficiency because the exceptions were small and isolated (illustrative).
Common mistakes
Assigning severity from the number of exceptions alone. The auditor also considers the amount exposed and how likely a misstatement would be.
Sources
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error