Definition
Under AU-C 265, a deficiency exists when a control does not let management or employees prevent, or detect and correct, misstatements on a timely basis. A significant deficiency sits one level below a material weakness: it is not severe enough to create a reasonable possibility of a material misstatement going unprevented, but it deserves governance attention.
Why it matters in an audit or review
The auditor must evaluate every deficiency noted and communicate significant deficiencies and material weaknesses in writing to those charged with governance. The written communication is a required deliverable and should be dated and retained in the file.
Example
Illustrative: a $30,000,000 company lets one accountant both create vendors and approve payments. No fraud is found, but the auditor judges the gap significant and reports it in the governance letter.
Common mistakes
- Treating the absence of an actual misstatement as proof the deficiency is minor.
- Sending only an oral communication.
- Not considering compensating controls before concluding on severity.
FAQ
What is the difference between a significant deficiency and a material weakness?
Severity. A material weakness creates a reasonable possibility that a material misstatement will not be prevented or detected timely. A significant deficiency is less severe but still reportable.
Sources
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
- AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error