Critical Criteria in Assessing Identified Internal Control Deficiencies What general factors should be considered by an auditor in evaluating whether or not a control deficiency is a material weakness, or a significant deficiency, or a control issue of lesser severity?

Answer 1

The following general factors should be considered as the auditor evaluates whether or not a control deficiency is a material weakness, a significant deficiency, or simply a control issue of lesser severity:
Assessing Likelihood of Misstatement
When the auditor is evaluating a control deficiency, the auditor assesses both the likelihood (whether there is a reasonable possibility) of misstatement and the magnitude of potential misstatement.
AS 5 notes that various risk factors affect the likelihood that a deficiency, or a combination of deficiencies, will result in a misstatement.
These factors include:
•The nature of the financial statement accounts, disclosures, and assertions involved
•The susceptibility of the related asset or liability to loss or fraud
•The subjectivity, complexity, or extent of judgment required to determine the amount involved
•The interaction or relationship of the control with other controls, including whether they are interdependent or redundant
•The interaction of the deficiencies
•The possible future consequences of the deficiency
Assessing the Magnitude of a Misstatement
AS 5 also identifies factors affecting the magnitude of the misstatement that might result from a deficiency, including:
•The financial statement amounts or total of transactions exposed to the deficiency
•The volume of activity in the account balance or class of transactions exposed to the deficiency that has occurred in the current period or that is expected in future periods.
Other Factors
Other factors to consider when assessing a control deficiency include:
1 . Control Environment. Weaknesses in specific components of the control environment have pervasive effects on the financial reporting process. More particularly, deficiencies in the competence of accounting personnel who deal with material account balances are normally considered a material weakness.
2 . Repeatability of a Process. If a deficiency is repeatable, such as in a computerized process, the more likely it is to be material.
3 . Volume of Transactions Affected. The auditor needs to assess the percentage of control failures multiplied by the average size of a transaction to determine if the amounts that could be misstated are material.
4 . Complexity and Subjectivity of the Account Balance. The more complex and subjective a material account balance is, the more likely that a deficiency will be material.
5 . Effectiveness of Oversight and Governance. One of the key elements of good internal control is that there should be strong oversight coming from the board of directors, and especially the audit committee. A lack of sufficient oversight would be considered a material weakness regardless of whether misstatements are actually detected in the financial statements.
6 . Existence of Compensating Controls. Often there are other controls in place that might compensate for a deficiency in a particular control and that make the original weakness less likely to be judged material.
7 . Remediation of a Control Deficiency. The auditor's report addresses whether there are material weaknesses in the internal control as of the company's year end. It is possible that a control deficiency may have been identified and remediated by the company prior to the company's year end. Thus, a deficiency that may have been considered a material weakness at an interim date would no longer be considered a material weakness at year end.