Evaluating Internal Control Deficiencies Guide

This guide focuses on the responsibilities and key issues management must consider when evaluating and identifying control deficiencies within their businesses. We will discuss a six-step system that can be applied to the evaluation process. The goals for this process are to help us discover which control(s) failed and why; identify the potential impact that the deficiency may have on financial statements; gather and analyze information about the deficiency including the root cause of the control failure; and finally, once a conclusion is reached as to the severity of the control deficiency, step back and reflect whether the conclusion reached properly supports, documents, and communicates the necessary information concerning a deficiency.


Control Deficiency: The design or operation of a control over your financial reporting that does not allow management or employees, in the normal course of performing their assigned duties, to prevent or detect misstatements in a timely manner.

Material Weakness: A deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected in a timely manner.

Significant Deficiency: A deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting.


The Securities Exchange Act of 1934 outlines that it is management’s responsibility to assess the severity of any deficiencies discovered, whether identified by you as management, an internal audit, or external auditors. It’s important to keep in mind that the severity of a control deficiency is not limited to whether misstatement has occurred, but the potential of misstatement occurring in the future if it’s not addressed. Management must address and communicate deficiencies in a timely manner. Proper evaluation of control deficiencies can assist you in determining how deficiencies may affect your records and financial statements, as well as how you might improve control processes to address any identified deficiencies. Now let’s look at the steps of the evaluation process.


STEP 1: Identify the deficiency and matters to be considered

Once a deficiency has been identified, you should begin to determine the nature and cause of the deficiency. Was there a misstatement identified as part of the deficiency? Was the period the deficiency was taking place during the current fiscal year? And questions concerning who is responsible for the operation of control and additional facts regarding any implementation and operation of controls in the deficiency should be considered as well.

STEP 2: Analyze the facts: consider the magnitude and likelihood of potential misstatement

It’s very important in this step to remember to account for the future as well as the present impacts when determining the potential magnitude of a deficiency on your financial statements. In this step we should also ask: what is the reasonable possibility that a deficiency, individually or in aggregate, will result in a misstatement?

STEP 3: Identify compensating controls

The severity of a deficiency may be offset by the presence of effectively designed, implemented, and operating controls. Questions that help to identify if a control could offset a deficiency are: did it help or could it help in identifying the deficiency, were the controls operating effectively during the period the deficiency was present, and are there other compensating controls that help reduce the overall impact of the deficiency?

STEP 4: Assess deficiencies for potential aggregation

When determining whether deficiencies should be combined due to potentially impacting the same area on your financial statements, you should look for any noted commonalities or differences in the deficiencies identified. This includes details like the nature, the underlying root cause, and component of internal control of the deficiencies.

STEP 5: Conclude on severity of the deficiency

Once you have gathered and analyzed the relevant facts, a judgment is to be made on the severity of a deficiency individually and in the aggregate with other deficiencies, as needed. Using the information and determinations made in the previous steps, you should determine whether it is a control deficiency, significant deficiency, or a material weakness.

STEP 6: Document conclusions and reporting considerations

Once a judgment has been made as to the severity of the deficiency, you should document your process for its conclusions to support the final assessment. This documentation may also be used by an external auditor to evaluate your conclusions. Additionally, management must consider the reporting implications depending on the severity of the deficiency and communicate accordingly. Material weaknesses should be reported by management on the Internal Control over Financial Reporting document for all public entities. Private companies do not have such a reporting requirement.

The final step is to evaluate and implement a change to your internal control system to correct the deficiency. Doing so not only alleviates the possibility of incorrect financial reporting but can also reduce the likelihood that an employee will exploit the deficiency to perpetrate fraud. The professionals at HHM can assist you in this endeavor.