Material weakness vs significant deficiency: how SOX grades a control gap

When a control does not operate as intended, the question is not 'did something go wrong', it is 'how severe is the gap'. SOX, through PCAOB AS 2201, grades every deficiency on two axes and lands it in one of three buckets. Get the grading right and your conclusion and disclosures follow cleanly; get it wrong and you either over-report or, worse, miss a material weakness.

The three levels

• Control deficiency: a gap in design or operation. Reported to management; ICFR can still be effective.
• Significant deficiency: less severe than a material weakness but important enough to merit the audit committee's attention. Reported in writing to the committee, but not disclosed publicly.
• Material weakness: a reasonable possibility that a material misstatement would not be prevented or detected on time. ICFR is 'not effective', and it is disclosed in the 10-K.

Likelihood times magnitude, after aggregation

Severity turns on likelihood (a reasonable possibility of failure, meaning more than remote) and magnitude (the potential misstatement, measured against materiality). Crucially, it depends on the possibility of failure, not on whether a misstatement actually occurred. And you must aggregate: several small deficiencies touching the same account or assertion can combine into a significant deficiency or a material weakness.

The overrides people forget

Some findings are material weaknesses almost by definition: fraud by senior management, a restatement to correct a material error, or an auditor finding a material misstatement your controls missed. There is also the prudent-official test: if a prudent official would not be comfortable, treat it as a material weakness. And a deficiency fixed late in the year must have operated for a sufficient period and been retested before year-end, or it persists at the as-of date.

A material weakness is about the possibility of failure, not proof that something broke. That one distinction decides most classifications.