An internal control deficiency can be caused by a number of issues but it is primarily defined as an error discovered during internal controls testing (e.g., a payment was coded to utilities when it should have been coded to inventory) or during a review of the internal control evidence (e.g., the internal or external auditors discover the coding mistake rather than management finding it as part of their closing activities). An internal control deficiency may also occur simply from someone forgetting to execute one of their internal controls entirely.
