Evaluating deficiencies: control deficiency, significant deficiency, material weakness

• Apply the definitions of deficiency, significant deficiency and material weakness
• Evaluate severity using reasonable possibility and potential magnitude
• Assess whether a compensating control is precise enough to reduce severity
• Recognize the indicators of a material weakness in AS 2201.69 and Release 33-8810

The definitions

Control deficiency (AS 2201.A3): exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A design deficiency means a necessary control is missing or an existing control would not meet its objective even if it operated as designed. An operating deficiency means a properly designed control does not operate as designed, or the performer lacks the authority or competence to perform it effectively.

Material weakness (Regulation S-X Rule 1-02(a)(4), Exchange Act Rule 12b-2, AS 2201.A7): a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. "Reasonable possibility" means the likelihood is either reasonably possible or probable, as those terms are used in the loss contingency literature.

Significant deficiency (Rule 1-02(a)(4), AS 2201.A11): a deficiency, or a combination of deficiencies, in ICFR that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of financial reporting.

Two questions for severity

AS 2201.63 says severity depends on:

1. whether there is a reasonable possibility that the controls will fail to prevent or detect a misstatement of an account balance or disclosure; and
2. the magnitude of the potential misstatement.

AS 2201.64 adds that severity does not depend on whether a misstatement actually occurred. A deficiency with no error found can still be a material weakness.

AS 2201.65 lists risk factors for likelihood, including the nature of the accounts and assertions, susceptibility to loss or fraud, the subjectivity and complexity involved, the interaction or relationship of the control with other controls (whether they are interdependent or redundant), the interaction of the deficiencies, and the possible future consequences. AS 2201.65 notes that the likelihood judgment can be made without quantifying it as a percentage. For magnitude, AS 2201.66 points to the amounts or total transactions exposed to the deficiency and the volume of activity in the current period and expected in future periods.

Compensating controls

AS 2201.68: compensating controls reduce severity only if they operate at a level of precision that would prevent or detect a misstatement that could be material. Test the compensating control before you rely on it. A quarterly analytic with a threshold of twice materiality does not compensate for a missing reconciliation.

Aggregation

Evaluate deficiencies individually and in combination. Release 33-8810 and the note to AS 2201.65 both say that multiple deficiencies affecting the same financial statement amount or disclosure increase the likelihood of misstatement and may, in combination, constitute a material weakness even when each one alone is less severe. Group deficiencies by account, assertion and COSO component, and by common root cause such as one weak ITGC affecting several applications.

Indicators of a material weakness

AS 2201.69 and Release 33-8810 list the same core indicators:

• identification of fraud, whether or not material, on the part of senior management;
• restatement of previously issued financial statements to correct a material misstatement;
• identification of a material misstatement in the current period in circumstances indicating ICFR would not have detected it;
• ineffective oversight of external financial reporting and ICFR by the audit committee.

The prudent official test

AS 2201.70 and Release 33-8810 both ask whether the deficiency would prevent prudent officials, in the conduct of their own affairs, from concluding they have reasonable assurance that transactions are recorded as necessary to prepare GAAP financial statements. If so, treat it as an indicator of a material weakness.

A workable sequence

1. Describe the deficiency: design or operation, control ID, period, root cause.
2. Identify the accounts, assertions and amounts exposed.
3. Assess likelihood with the AS 2201.65 factors.
4. Estimate potential magnitude, not just the error found.
5. Test and evaluate compensating controls for precision.
6. Aggregate with related deficiencies.
7. Check the indicators and the prudent official test.
8. Conclude and document who reviewed the conclusion.

Severity evaluation for an unreviewed revenue reserve at Granger Medical Supply