What it is
Management’s evaluation of internal control over financial reporting has to decide, for each deficiency found, whether it is a deficiency, a significant deficiency or a material weakness, and whether related deficiencies add up to something worse. This matrix does that from management’s side, with remediation status at the evaluation date.
It logs each deficiency with the reasonable-possibility and magnitude questions, compensating controls and indicators, proposes a classification from your thresholds and lets you record the conclusion. Matrix and aggregation tabs show what is still outstanding by COSO component and by process area.
When to use it
- When management evaluates test results at an interim date and at year-end.
- When several related deficiencies might combine into a significant deficiency or material weakness.
- To show the audit committee what is outstanding, by component.
What’s inside
- Parameters with materiality, screening threshold and evaluation date
- Log of up to 30 deficiencies with design or operating failure and severity screen
- Remediated-and-retested flag that removes an item from the outstanding count
- Matrix by COSO component and aggregation by process area
- Summary with checks and the indication that follows from the matrix
Standard cited
This template follows SEC Rule 13a-15 / Reg S-X 1-02(a)(4). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
How does the SEC define a material weakness?
Regulation S-X Rule 1-02(a)(4) defines it as a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.
Can a remediated deficiency be excluded?
Only if the remediated control was in place long enough to be tested and was retested as operating effectively before the evaluation date. The sheet takes a Yes on that question as the basis for treating the item as remediated, so enter it only with the retest evidence in the file.
Related templates
- Significant Deficiency vs Material Weakness Evaluation (AU-C 265)
- SOX Control Deficiency Evaluation Worksheet
- ICFR Deficiency Communication Memo to the Audit Committee
- Control Remediation Tracker
Last updated 11/05/2026. All free templates.