All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
What is the difference between manual and automated controls? When does the auditor decide to test controls versus take a fully substantive approach? How do you document the understanding of internal controls? What are compensating controls and how do they affect the audit? What are IT general controls (ITGCs) and why do they matter? How does management override of controls create risk, and how do auditors address it? How do you evaluate controls in a system that uses a service organization (SOC reports)? What is the auditor's responsibility for reporting internal control deficiencies?
Advertisement
Auditing & Assurance › Internal Controls Evaluation

What is the difference between a deficiency, a significant deficiency, and a material weakness?

Advanced

Answer

A control deficiency exists when a control doesn't prevent or detect misstatements timely. A significant deficiency is a deficiency (or combination) important enough to merit attention by those charged with governance. A material weakness is a deficiency (or combination) creating a reasonable possibility that a material misstatement won't be prevented or detected—the most severe, and reportable in ICFR audits.
Severity: deficiency < significant deficiency < material weakness.
Real-world example A missing bank reconciliation that could hide a material error is escalated as a material weakness in the ICFR audit.

Common follow-ups: What distinguishes a material weakness? | Who must significant deficiencies be reported to?

Audit Report & Opinions ISA Standards Internal Controls Evaluation
All 18 Internal Controls Evaluation questions