Material weakness vs significant deficiency: the two tests that decide it, with examples

The short answer: a material weakness is a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe than that, yet important enough to merit attention by those responsible for oversight of financial reporting. Both definitions are in Appendix A of PCAOB AS 2201, at paragraphs .A7 and .A11. The difference is severity, and severity is decided by two separate questions rather than one.

The practical stakes are not subtle. A material weakness means your internal control over financial reporting is not effective, which management has to say out loud in the 10-K and the auditor has to say in an adverse opinion. A significant deficiency goes to the audit committee in writing and stops there. Nobody outside the company learns about it. So the classification decision is, in effect, a disclosure decision, which is exactly why auditors and management argue about it in February.

What is a material weakness?

A material weakness is a control failure severe enough that a material misstatement could get all the way through your financial statements without being caught in time. Note what the definition does not say. It does not require that a misstatement happened, or that anyone was harmed, or that the amount involved was large. It asks a forward-looking question about what the broken control could have let through.

It also covers combinations. A single control gap that looks survivable on its own can become a material weakness when you aggregate it with three others in the same process, because the definition says "a deficiency, or a combination of deficiencies." This is the part teams miss most often. They evaluate twelve exceptions one at a time, conclude each is a significant deficiency, and never ask what the twelve together mean for the same account.

What is a significant deficiency?

A significant deficiency is a deficiency, or a combination of deficiencies, that is less severe than a material weakness but still important enough that the audit committee should hear about it. The definition is deliberately relative: it is defined by what it is not. There is no dollar threshold and no likelihood percentage anywhere in the standard, which means you cannot arrive at "significant deficiency" by arithmetic. You arrive at it by concluding that a material weakness test failed, and then judging that the issue still deserves oversight attention.

The auditor must communicate all significant deficiencies and material weaknesses in writing to management and the audit committee. That written communication is discoverable, and it is the reason a significant deficiency that recurs for three years tends to get reclassified in year four. Repetition is evidence about your control environment, not just about one control.

Material weakness vs significant deficiency vs control deficiency

Three levels exist, and the boundaries only run one way: every material weakness is also a deficiency, but not the reverse.

How do you decide which one it is?

Two independent questions, asked in this order. First, what is the magnitude of the misstatement that could result, not the misstatement you found. Second, what is the likelihood that the broken control fails to prevent or detect it. A material weakness needs a yes on both: material magnitude and at least a reasonable possibility.

"Reasonable possibility" is the term that trips people, because it is a lower bar than probable. It borrows from the accounting definition of contingencies, where reasonably possible sits between remote and probable. So an outcome you consider unlikely can still clear the threshold. If your reasoning is "this almost certainly would not have happened," you have not yet answered the question the standard asks.

The magnitude half is where good teams gain ground. Work out the maximum exposure of the account or assertion the control covers, and compare that to materiality, not to the error you happened to find. A $3,000 pricing error uncovered in a revenue process where a $6 million error could pass unchecked is a material weakness. A $2 million error caught by the very control you were testing might not be one, because the control worked.

Then check whether a compensating control genuinely covers the gap. To count, it has to operate at a level of precision that would catch a misstatement of material size, and you have to have tested it. A monthly management review that looks at variances above 10 percent does not compensate for a control protecting an account where 4 percent is material. This is the single most common failed argument in severity discussions.

Material weakness examples

PCAOB AS 2201 paragraph .69 names four circumstances that should be regarded as indicators of a material weakness on sight:

• Fraud of any size involving senior management, regardless of materiality.
• A restatement of previously issued financial statements to correct a material misstatement.
• A material misstatement identified by the auditor in the current period that your own controls would not have caught.
• Ineffective oversight of external financial reporting and internal control by the audit committee.

Any one of those shifts the burden onto you to explain why it is not a material weakness. Beyond the indicator list, the patterns that recur in actual 10-K disclosures are remarkably consistent: insufficient qualified accounting personnel for the complexity of the business, no segregation of duties in a process where one person initiates and approves, general IT controls that let developers push changes to production financial systems without independent review, no effective control over non-routine or judgmental transactions such as acquisitions and impairments, and account reconciliations that are prepared but never independently reviewed.

Two of those deserve a note on remediation, because the instinct is usually wrong. When a review control fails, teams add a second reviewer, which doubles the cost and rarely changes the precision. Where the underlying data is entered by hand and reviewed by eye, as in expense and procurement cycles, the durable fix is usually to enforce the policy check inside the system that captures the spend so the exception never reaches a reviewer's inbox in the first place. Automated prevention is cheaper to test than manual detection, and the FY24 KPMG survey found the automated share of key controls actually fell to 17 percent, which is why so many programs are now paying 16 hours of testing per control.

Significant deficiency vs material weakness examples

Contrast is the fastest way to see the line. The same broken control can land in either bucket depending on what sits behind it.

Notice that the deciding factor in every row is never the exception rate. It is the size of what could have got through and whether a tested control stood behind it.

Is a material weakness bad?

It is serious, and it is survivable. A material weakness is not a restatement, not an accounting error, and not a finding of wrongdoing. Around 46 percent of companies disclose at least one material weakness while going public, according to PwC's analysis of IPO disclosures, which tells you the base rate at organizations that have never had to run the process before. Plenty of large filers have disclosed one, remediated it over two to four quarters, and returned to an effective conclusion.

The real costs are indirect. Audit fees rise because the auditor expands testing. Covenant and rating conversations get harder. Filing timeliness comes under pressure in the year you are remediating and closing at the same time. And a material weakness in a period you have already certified raises questions about the Section 302 disclosure controls conclusion in the quarters before you found it.

What are the material weakness disclosure requirements?

Three obligations fire at once. Management's annual report on internal control over financial reporting must conclude that ICFR is not effective, and it must identify the material weakness rather than merely mention that one exists. The disclosure controls and procedures conclusion under Section 302 has to be revisited, because a control gap that lets a material misstatement through generally affects disclosure controls too. And if the weakness was identified during a quarter, the change in internal control over financial reporting has to be described in that 10-Q.

Useful disclosure names the affected process, explains what could have gone wrong, and states the remediation plan with an expected timeline. Vague disclosure invites comment letters. And a critical timing rule: if you remediate between fiscal year end and the filing date, you may describe the remediation in the 10-K, but you cannot change the year-end conclusion. ICFR effectiveness is assessed as of the balance sheet date, and no amount of February progress moves that date.

Does a material weakness change the audit opinion?

It changes one of the two opinions. In an integrated audit under AS 2201, the auditor gives an opinion on internal control over financial reporting and a separate opinion on the financial statements. A material weakness at year end produces an adverse opinion on ICFR. It is adverse, not qualified, because there is no partial-credit outcome for internal control.

The financial statement opinion can still be unqualified, and usually is. The auditor compensates by doing more substantive testing, concludes the statements are fairly stated, and says so. That combination, an unqualified opinion on the statements and an adverse opinion on ICFR, is common and it is not a contradiction. The numbers can be right even when the system that produced them cannot be relied on to keep them right.

Companies exempt from Section 404(b), which since the SEC's 2020 amendments includes smaller reporting companies with under $100 million in annual revenue, get no auditor ICFR opinion at all. They still disclose the material weakness in management's own assessment. Our SOX compliance guide sets out the full filer thresholds and which sections apply at each level.

How do you remediate a material weakness?

Remediation is a design change plus enough evidence of operation. Four steps, in order, and the last one is where programs stall:

• Find the root cause, not the symptom. "The review was not documented" is a symptom. "One controller covers three entities and closes them sequentially" is a cause. Fixing the symptom produces the same finding next year.
• Redesign the control so it operates at sufficient precision. State the threshold, the population, the evidence and the frequency. If you cannot write down what would make it fail, you cannot test it.
• Operate it long enough to test. A monthly control needs several months of operation before there is anything to sample. This is why a weakness found in Q4 rarely gets remediated by year end, and why finding it in Q1 is worth a great deal.
• Test it and document the conclusion. Management concludes remediation, then the auditor tests independently. Both have to happen before the conclusion changes, and the auditor will want the period tested to end on or before the balance sheet date.

The programs that clear weaknesses fastest treat the whole thing as a scoping and calendar problem rather than a documentation problem. They know which controls are load-bearing, they find exceptions in the first half of the year, and they keep the risk and control matrix current enough that a new system or a new revenue stream reaches scoping before the auditor finds it. That is the work SOX compliance software should be doing for you, and the mechanics of the testing itself are covered in SOX 404 testing and the SOX 404 audit requirements.