ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
SOX control deficiency evaluation is the step that decides whether a failed control is a routine fix, a significant deficiency that goes to the audit committee, or a material weakness that changes your conclusion on internal control over financial reporting. Many teams find a problem, patch it and move on without recording why the severity was judged as it was. Auditors and the SEC expect a reasoned evaluation, and PCAOB Auditing Standard 2201 sets out the framework that most companies follow.
This guide walks through the evaluation, using the definitions and factors in AS 2201. It complements our guides to material weakness, SOX 404 and SOX control testing. This is general information, not audit or legal advice.
The PCAOB standard defines the categories. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is a deficiency, or combination, that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of financial reporting.
| Category | Meaning | Typical consequence |
|---|---|---|
| Control deficiency | A control does not allow timely prevention or detection of misstatements | Fix and track |
| Significant deficiency | Less severe than a material weakness but merits oversight attention | Report to the audit committee |
| Material weakness | Reasonable possibility of a material misstatement not being prevented or detected | ICFR cannot be concluded as effective |
The word “reasonable possibility” is not a probability threshold. It is a judgement about whether the chance of a misstatement is more than remote, and it needs to be reasoned and recorded.
Write a short factual description: which control, what failed, when, how it was found and which accounts and assertions it relates to. Say whether the problem is in design, meaning the control as designed cannot meet its objective, or in operation, meaning a well-designed control did not work as intended. Include the period affected and any related deficiencies, since combinations of deficiencies can be more severe together.
According to AS 2201, the severity of a deficiency depends on two factors, and it does not depend on whether a misstatement actually occurred.
Consider factors such as the nature of the accounts and disclosures affected, susceptibility of the related assets or liabilities to loss or fraud, the subjectivity and complexity of the amounts, the interaction with other controls, and the possible future consequences. Document each in a short table, with a note on why it points to higher or lower severity.
Deficiencies that affect the same account, assertion or component of internal control should be evaluated together. Two moderate deficiencies over the same reconciliation may amount to a material weakness in combination. Keep a log of all open deficiencies, and review it at the end of each quarter for related items.
A compensating control may reduce the severity of a deficiency, but AS 2201 sets a demanding test. The compensating control must operate at a level of precision that would prevent or detect a misstatement that could be material. It is not enough that another control exists. You must identify it, show it works and show it would catch the type and size of error the deficient control was meant to catch. Test it in the same way you test key controls, and record the results. Our guides to IT general controls and segregation of duties discuss two common areas where compensating controls are proposed.
The standard lists indicators that should lead you to treat a deficiency as at least a strong indicator of a material weakness. AS 2201 names four:
The same standard also applies a “prudent official” test. If the deficiency would prevent prudent officials, in the conduct of their own affairs, from concluding that they have reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, it is at least a significant deficiency, and potentially more. Apply this common-sense test as a check on your analysis.
State the conclusion: control deficiency, significant deficiency or material weakness. Record who made the judgement and when, and the evidence used. For significant deficiencies and material weaknesses, inform the audit committee and the external auditor promptly, and discuss the remediation plan. Material weaknesses have implications for management’s report on ICFR and for related disclosures, so involve legal counsel and the disclosure committee early.
Agree a remediation plan with an owner, a design of the fix and a due date. After implementation, the control must operate for enough time and enough instances to demonstrate that it works, and then be tested. Keep the retest evidence with the original evaluation. Remediation is not complete when the process changes. It is complete when testing shows the redesigned control works.
Evaluation works best as a routine, not an emergency. Set a quarterly cadence: collect new deficiencies from testing, internal audit, the external auditor and management review, evaluate each using the template, and bring the results to the disclosure committee. A standing calendar avoids last-minute judgements near the year-end, when time is short and pressure is high. Link the log to your SOX scoping so that every deficiency is mapped to the significant accounts and assertions at risk.
Train the people who make the calls. Finance managers, internal audit staff and control owners should understand the two severity factors and the compensating control test. A short workshop using two or three past cases is usually enough. Consistent SOX control deficiency evaluation across business units also stops the same problem being rated differently in different places.
The external auditor performs its own evaluation, so agree early on how you will share analyses. Bring your written conclusion and evidence, and ask for the auditor’s view before the audit committee meets. If you disagree, discuss the facts and the reasoning, not just the label. Where the auditor concludes that a material weakness exists, the auditor’s report will say so, so it is better to resolve differences during the year than in the final weeks.
A hypothetical manufacturer finds that a monthly revenue accrual review was performed late in two quarters, and reviewers did not document what they examined. The controller describes the deficiency as one of operation and looks at exposure: accruals could be misstated by an amount close to materiality. She identifies a compensating control, an analytical review by the finance director, but finds that it works at too high a level to detect an error of that size. The team concludes that the deficiency is a significant deficiency, reports it to the audit committee and redesigns the review with documented procedures. After two quarters of operation and testing, the deficiency is closed. This example is invented for illustration.
Read the full text of PCAOB Auditing Standard 2201 and discuss any borderline judgement with your external auditor.
To avoid building deficiency logs, evaluation forms and remediation trackers from scratch, the SOX Toolkit provides documents you can adapt. Have your external auditor and counsel review them.
Whether there is a reasonable possibility of a material misstatement not being prevented or detected on a timely basis, judged by likelihood and magnitude.
No. Severity depends on the potential for misstatement, not on whether one happened.
Yes, if it operates at a level of precision that would prevent or detect a material misstatement, and it has been tested.
The audit committee and the external auditor, according to standard practice. Confirm your own reporting duties with counsel.
When the redesigned control has operated long enough and been tested successfully.
September 30, 2026
