What is the difference between a significant deficiency and a material weakness?

News and analysis for the well-informed compliance or audit exec.

Already a Compliance Week member? SIGN IN

A material weakness is when one or more of a company's internal controls—activities, rules, and processes designed to prevent significant financial statement irregularities and improve operation efficiency—is ineffective. If a deficiency in internal control is a material weakness, it could result in a material misstatement in a company's financial statements. This would make the company's financial statement data unreliable and ineffective for assessing the company's financial health and determining a reasonable company stock price.

When an audit is conducted and a material weakness in the company's internal controls is detected, the auditors report the material weakness to the audit committee. Every publicly-traded company in the US must have a qualified audit committee. The audit committee, a part of the board of directors, requires that the company's management take steps to fix the controls and rectify the material weakness.

• A material weakness exists when one or more internal controls fail.
• When identified, a firm's audit committee must take steps to remedy the weakness.
• An unresolved material weakness can result in a material misstatement - incorrect information in a financial statement that can alter the decisions of its users.
• US companies must follow Generally Accepted Accounting Principles (GAAP) when preparing financial statements.
• A significant deficiency is one or more deficiencies in a company's financial reporting and is less severe than a material weakness.

A material weakness, when reported by an auditor, simply suggests that a misstatement could occur. If a material weakness remains undetected and unresolved, a material misstatement could eventually occur in a company's financial statements. An error in the company's financial statements may have a tangible effect on a company's valuation.

In the US, companies must follow the Securities Exchange Committee (SEC) adopted Generally Accepted Accounting Principles (GAAP) when preparing financial statements. Most US firms subscribe to the 5% materiality rule, which states that misstated values 5% above bases (e.g., gross profit, net income, etc.) is material.

Sometimes, material weakness and significant deficiency are used interchangeably. They both identify deficiencies, but one carries more weight than the other. A significant deficiency, which is one or more weaknesses in a company's financial reporting, warrants attention but is less likely to have an impact on the financial statements as with material weaknesses.

GAAP does not safeguard against or provide guidance on what are material weaknesses.

For example, a $100 million overstatement in revenue would be a material misstatement for a company generating sales of $500 million annually. Incorrect company valuations, as a result of the material weaknesses, may affect the company's stock price. Due to their potential to hinder the integrity of the public, material weaknesses in a company's internal controls must be identified promptly.

In October 2018, Costco Wholesale (COST) reported a material weakness in its internal control. According to a press release, "The weakness relates to general information technology controls in the areas of user access and program change-management over certain information technology systems that support the Company's financial reporting processes." In simpler terms, unauthorized persons may have gained access to the company's financial reporting systems.

The company also reported that they did not identify any misstatements in the financial reports and that remediation efforts began immediately. Soon after their public announcement, their stock price fell by approximately 4%.

In 2019, Costco completed their remediation efforts, concluding that its internal controls over financial reporting was tested and operating effectively as of September 2019.

Material weaknesses can adversely affect a company's reputation and, subsequently, its value. A company's stock price may drop as some investors deem the company as a risky investment. Depending on the result of the weakness, the company may expend large sums to cover legal and additional external auditing fees. Also, employees, particularly management, may be heavily scrutinized and subject to disciplinary actions for their lack of oversight.

A material weakness, which is more severe than a significant deficiency, is an internal control deficiency or collection of deficiencies that create a material misstatement in a company's financial statements. A significant deficiency, according to the SEC, is one that negatively affects the "company's ability to record, process, summarize and report financial information, to the external auditor and the audit committee, with the intended result that these parties can more effectively carry out their respective responsibilities with regard to the company’s financial reporting."

There are several indicators of material weaknesses in internal controls. Some of the most notable include evidence of fraud by senior leaders, the identification of a financial misstatement in the company's financial statement missed by the company's internal controls but caught by an auditor, and poor management of a company's external and internal financial reporting.

A1.      For purposes of this standard, the terms listed below are defined as follows -

A2.      A control objective provides a specific target against which to evaluate the effectiveness of controls. A control objective for internal control over financial reporting generally relates to a relevant assertion and states a criterion for evaluating whether the company's control procedures in a specific area provide reasonable assurance that a misstatement or omission in that relevant assertion is prevented or detected by controls on a timely basis.

A3.      A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

• A deficiency in design exists when (a) a control necessary to meet the control objective is missing or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met.
• A deficiency in operation exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.

A4.      Financial statements and related disclosures refers to a company's financial statements and notes to the financial statements as presented in accordance with generally accepted accounting principles ("GAAP"). References to financial statements and related disclosures do not extend to the preparation of management's discussion and analysis or other similar financial information presented outside a company's GAAP-basis financial statements and notes.

A5.       Internal control over financial reporting is a process designed by, or under the supervision of, the company's principal executive and principal financial officers, or persons performing similar functions, and effected by the company's board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP and includes those policies and procedures that -

Note: The auditor's procedures as part of either the audit of internal control over financial reporting or the audit of the financial statements are not part of a company's internal control over financial reporting.

Note: Internal control over financial reporting has inherent limitations. Internal control over financial reporting is a process that involves human diligence and compliance and is subject to lapses in judgment and breakdowns resulting from human failures. Internal control over financial reporting also can be circumvented by collusion or improper management override. Because of such limitations, there is a risk that material misstatements will not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk.

A6.      Management's assessment is the assessment described in Item 308(a)(3) of Regulations S-B and S-K that is included in management's annual report on internal control over financial reporting. 2/

A7.      A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis.

Note: There is a reasonable possibility of an event, as used in this standard,  when the likelihood of the event is either "reasonably possible" or "probable," as those terms are used in Financial Accounting Standards Board Statement No. 5, Accounting for Contingencies ("FAS 5"). 3/

A8.      Controls over financial reporting may be preventive controls or detective controls. Effective internal control over financial reporting often includes a combination of preventive and detective controls.

• Preventive controls have the objective of preventing errors or fraud that could result in a misstatement of the financial statements from occurring.
• Detective controls have the objective of detecting errors or fraud that has already occurred that could result in a misstatement of the financial statements.

A9.      A relevant assertion is a financial statement assertion that has a reasonable possibility of containing a misstatement or misstatements that would cause the financial statements to be materially misstated. The determination of whether an assertion is a relevant assertion is based on inherent risk, without regard to the effect of controls.

A10.    An account or disclosure is a significant account or disclosure if there is a reasonable possibility that the account or disclosure could contain a misstatement that, individually or when aggregated with others, has a material effect on the financial statements, considering the risks of both overstatement and understatement. The determination of whether an account or disclosure is significant is based on inherent risk, without regard to the effect of controls.

A11.    A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting.