Internal Control Deficiency Measurement in 5 Steps

Posted by Teresa Bockwoldt on April 13, 2011

An internal control deficiency can be caused by a number of issues but it is primarily defined as an error discovered during internal controls testing (e.g., a payment was coded to utilities when it should have been coded to inventory) or during a review of the internal control evidence (e.g., the internal or external auditors discover the coding mistake rather than management finding it as part of their closing activities).  An internal control deficiency may also occur simply from someone forgetting to execute one of their internal controls entirely.

An internal control deficiency does not automatically equate to a material weakness (defined below).  When an internal control deficiency occurs, the deficiency should be analyzed to determine the significance of the error to your company. 

The 5 steps to understanding how to analyze deficiencies below are detailed at a very high level and do not cover all possible ways to analyze a deficiency, but, this should provide some guidance with understanding the overall process.

Step 1: Define the overall materiality threshold for your company. 

Determine a dollar value that will be used to calculate materiality based on management’s consideration and where possible, recommendations from your auditors. This determination will allow you to define the dollar amounts and where to focus your internal audit and review efforts on. Officially, this step should occur prior to undertaking any controls documentation effort as it determines the areas of your company that should have internal controls.

Determining the Materiality Threshold Value

Many Big 4 auditing firms will use (+-) 5% of pre-tax income as the basis for the materiality threshold.  If your company does not have pre-tax income, they may use (+-) 5% of another account such as fixed assets, accounts payable, revenue, etc. as their guidance. 

NOTE: According to paragraph 20 of the PCAOB Bylaws and Rules Standards AS5, the same materiality value used for the annual financial audit should also be used for a Sarbanes-Oxley audit.

The purpose of this step is to focus the audit scope on areas that have the most risk.  For instance, more attention should be given to ensuring an account with $100,000 value is accurate rather ensuring petty cash with $250 is accounted for properly.  This holds especially true when you are paying upwards of $250 an hour for someone to perform the review…

Let’s say for the sake of this blog post that your materiality threshold was based on 5% of pre-tax income and calculated to be $146,740.

Step 2: Assign dollar values to the 3 available levels of deficiencies based on your materiality threshold.

There are three possible levels of deficiency for any error found:

  1. Material Weakness (requires an 8K and disclosure in your 10Q/K)
  2. Significant Deficiency (requires escalation to the Board of Directors / Audit Committee)
  3. Deficiency (should be disclosed to your Board of Directors / Audit Committee)

Vibato’s recommendation and the Vibato® Internal Control Suite™ Risk Assessment tool allows you to enter in percentages that will calculate against the materiality threshold (step 1) to assign dollar values of each of the three deficiency levels. The determination of how much of your materiality threshold to apply to each deficiency level is subjective and should also be reviewed with your external auditors. 

For the sake of this blog post, let’s say we assigned 80% of the materiality threshold to the material weakness value and 30% to the significant deficiency value:


What this means is:

  • A deficiency with a value of $117,392 or greater is a material weakness
  • A deficiency with a value between $35,217.60 - $117,293.00 is a significant deficiency.
  • A deficiency of up to $35,217.60 is simply a deficiency.

The formal definitions of the deficiency levels are as follows:

PCAOB: Auditing Standard No. 5 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements

A7. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis.

A11. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting.

A3. A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.  

Step 3: Determine the value of the deficiency.

The absolute value of a deficiency can sometimes be difficult to determine.  A general example of a deficiency value is if you find that a payment was made incorrectly. Let’s say for the sake of this blog post that the error found was valued at $42,500.

Step 4: Assess the value of the deficiency against your materiality threshold.

Using the values assigned in the above examples, the $42,500 deficiency would constitute a significant deficiency.  I.e.:

  • A deficiency with a value between $35,217.60 - $117,293.00 is a significant deficiency.

The assessment process doesn’t stop with just looking at the dollar value.  You can also argue that perhaps you have other controls in place that would lessen the impact of the deficiency found or that would perhaps have caught the error entirely at some point in the process and before the financials were reported to the SEC. Formalizing these types of arguments can be especially important if you are looking at a potential material weakness. 

Step 5: Review your work with your auditors.

Your auditors will need to review your analysis and assessment to determine if they agree and share your perspective.  As you can imagine, it is better to agree with your auditors on your materiality thresholds prior to finding an issue so start the process of assessing your materiality, material weakness, significant deficiency, and deficiency values as soon as possible. Taking the time to determine these amounts and gaining external audit agreement may save you time, money, and perhaps an unwanted deficiency assessment.

Tags: Internal Controls, Compliance tools, risk assessment, audit, SOX, 404 audit, best-practice, Controls Testing, 10k, Product Information, Sarbanes-Oxley Training, compliance, risk management, Sarbanes-Oxley, audit deficiency, Internal Control Deficiency