Material Weakness vs Significant Deficiency: The Definitive Guide

A material weakness is the most serious finding an assessment of internal control over financial reporting can produce, and the definition that governs it is short: “a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis” — PCAOB Auditing Standard 2201, Appendix A, mirrored in the SEC’s rules. One rung down sits the significant deficiency: “less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.” Below both is the plain deficiency. The three-level scale looks like a matter of degree and is in fact a matter of consequence: the top level means ICFR is not effective, management says so in its 404(a) report, the auditor issues an adverse opinion under 404(b), and the market reads both. This guide sets out the three definitions, the two-factor test that separates them, the indicators AS 2201 treats as presumptive, the role of compensating controls, who is told what, and how remediation is evidenced so the weakness closes.

The three definitions

Two words in the top definition do the work. “Reasonable possibility” is defined by reference to FAS 5 (now ASC 450): the likelihood is either reasonably possible or probable — a lower bar than “likely”. And “material misstatement” ties the assessment to materiality for the financial statements as a whole, interim as well as annual.

The material weakness test: likelihood and magnitude

AS 2201 .63 states that the severity of a deficiency depends on two things: whether there is a reasonable possibility that the controls will fail to prevent or detect a misstatement of an account balance or disclosure, and the magnitude of the potential misstatement. Paragraph .64 adds the point most often missed: severity “does not depend on whether a misstatement actually has occurred”. A control that failed and, by luck, produced no error is assessed on what could have happened.

Indicators of a material weakness

AS 2201 .69 lists four indicators — circumstances that point strongly to a material weakness whatever the likelihood-and-magnitude analysis says:

• identification of fraud, whether or not material, on the part of senior management;
• restatement of previously issued financial statements to reflect the correction of a material misstatement;
• identification by the auditor of a material misstatement in the current period in circumstances indicating it would not have been detected by the company’s ICFR; and
• ineffective oversight of external financial reporting and ICFR by the audit committee.

The third indicator is the everyday one: an audit adjustment that is material is, in effect, evidence that the controls did not catch it. The first is the reason a fraud by a senior officer for a trivial amount still qualifies — it speaks to the control environment, not the amount. Our guide to entity-level controls covers the environment and oversight controls the fourth indicator tests.

Who is told what

Smaller reporting companies and non-accelerated filers make the management assessment without the auditor’s attestation, but the definitions and the disclosure are the same. Our guide to SOX 404 covers who is subject to which part.

Remediating the weakness

1. Fix the root cause, not the symptom. A weakness in revenue recognition caused by a missing review control is not remediated by a one-off review of last quarter; it needs the control designed, assigned to someone with competence and authority, and operating.
2. Design to the precision the weakness needs. The remediated control must be capable of preventing or detecting a misstatement that could be material — the same precision standard .68 applies to compensating controls.
3. Operate it for enough periods. A control has to operate for a sufficient period, and be tested, before management or the auditor can conclude it is effective; a control implemented in the last month of the year usually leaves the weakness open at year end.
4. Test it as the auditor will. Design (walkthrough: does it meet the objective if operated as prescribed?) and operation (does it operate as designed, by someone with the competence and authority?), with evidence of the investigation and resolution of exceptions, not sign-offs alone.
5. Disclose the remediation plan and progress. Item 9A and the quarterly changes-in-ICFR disclosures track it; investors and the audit committee expect a plan with dates.
6. Re-assess the aggregation. Closing one deficiency can leave a combination that is still significant; the aggregation analysis is redone, not assumed.

Frequently asked questions

What is the difference between a material weakness and a significant deficiency?
Severity. A material weakness is a deficiency or combination where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis; it makes ICFR ineffective and is disclosed. A significant deficiency is less severe than that but important enough to merit the audit committee’s attention; it is communicated in writing to the committee and ICFR can still be effective.

Does a misstatement have to have occurred?
No. AS 2201 .64 says severity does not depend on whether a misstatement actually occurred, but on whether there is a reasonable possibility the controls would fail to prevent or detect one. A control failure with no resulting error can still qualify.

Can compensating controls prevent that conclusion?
Yes, if they operate at a level of precision that would prevent or detect a misstatement that could be material (AS 2201 .68). A high-level review that would not catch a material error does not count.

Is a restatement automatically a material weakness?
A restatement to correct a material misstatement is one of the four indicators in AS 2201 .69. It is not an automatic conclusion, but it creates a strong presumption that the auditor and management must rebut with analysis.

How long does a material weakness take to remediate?
Until the redesigned control has operated for enough periods to be tested and found effective — typically at least a quarter, often longer for annual controls. It is reported until then, with the remediation plan disclosed.

Where this leaves you

Classify every deficiency with the two-factor test in writing — reasonable possibility, magnitude, compensating controls at material precision, combinations by account — check it against the four indicators, and let the classification drive the communication: significant deficiencies to the audit committee, the top level to the world. Then remediate at the root, at the right precision, for long enough to test, because the standard asks what the controls would prevent, not what they happened to catch.

References

• PCAOB AS 2201 — An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements — Appendix A definitions (.A3, .A7, .A11); .62–.70 evaluating identified deficiencies; .78–.80 communications; .90–.91 adverse opinions.
• SEC — Accelerated filer and large accelerated filer definitions — Which registrants are subject to the auditor attestation under 404(b).
• COSO — Guidance on Internal Control — The framework against which deficiencies are evaluated by component and principle.

More on internal control

• Material weakness vs significant deficiency — you are here
• SOX 404: management assessment and auditor attestation
• SOX compliance: the complete guide
• Entity-level controls
• Management review controls: precision and evidence
• The COSO 17 principles

The deficiency evaluation worksheet with the likelihood-and-magnitude analysis, the aggregation register by account and component, the remediation plan template and the audit committee communication are in the COSO ERM & Internal Control Toolkit, or start with the free templates.