Join the waitlist
Glossary/Risk and controls

Material weakness

A material weakness is a deficiency, or combination of deficiencies, in internal control where there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected on a timely basis.

CORAA TeamUpdated November 5, 2026

Definition

A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected on a timely basis. It is the most severe level of deficiency in AU-C 265, above a significant deficiency.

Why it matters in an audit or review

If the auditor identifies a material weakness during a financial statement audit, AU-C 265 requires written communication to management and those charged with governance. Whether a deficiency is a material weakness depends on the likelihood and magnitude of misstatement, not on whether a misstatement actually occurred. AU-C 265 lists indicators: fraud of any size by senior management, restatement of previously issued statements to correct a material misstatement, a material misstatement the auditor finds that the entity's controls would not have detected, and ineffective oversight by those charged with governance.

Example

The auditor proposes an adjustment of $400,000 to record unrecorded accrued liabilities, which exceeds materiality (illustrative: $250,000). The company has no process to identify liabilities at year end, and the auditor found the misstatement. This is a strong indicator of a material weakness in the period-end financial reporting process, so it is communicated in writing along with the nature of the issue.

Common mistakes

Waiting for an actual misstatement before concluding. The test is reasonable possibility, so a design gap can be a material weakness even with no error yet.

FAQ

Does an unmodified opinion mean there are no material weaknesses?

No. In a financial statement audit the opinion does not address internal control. Material weaknesses can exist and be communicated separately.

Sources

  • AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
  • PCAOB, AS 2201 (same definition of a material weakness in an audit of internal control over financial reporting)

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 265

Related terms

  • Significant deficiency
    A significant deficiency is a deficiency or combination of deficiencies in internal control that is less severe than a material weakness yet important enough to merit the attention of those charged with governance.
  • Control deficiency
    A control deficiency exists when the design or operation of a control does not let management or employees prevent, or detect and correct, misstatements on a timely basis.
  • Internal control over financial reporting
    Internal control over financial reporting is the process that management designs and runs to give reasonable assurance that financial statements are reliable and prepared under the applicable framework.
  • Compensating control
    A compensating control limits the risk created by a missing or weak control by operating at a level of precision that would catch a material misstatement the primary control would have caught.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required