What it means
Internal controls are the routine safeguards built into everyday processes: purchase approvals, bank reconciliations, splitting duties so nobody both raises and pays an invoice, and limiting who can change a supplier's bank details. A control deficiency is simply the finding that one of those safeguards does not work as intended.
Deficiencies come in two flavours. A design deficiency means the control could never achieve its purpose even if performed perfectly, for example a spending limit set so high that nothing ever needs a second signature.
An operating deficiency means the control is sensibly designed but is not actually carried out, such as a reconciliation that is signed off without being checked. Severity is judged on two axes: how large a misstatement could result, and how likely that outcome is.
A deficiency that could not conceivably move the numbers much is just a deficiency, one that deserves the attention of the audit committee is a significant deficiency, and one where a material error could realistically go undetected is a material weakness. The distinction has real consequences beyond paperwork.
A disclosed material weakness can raise borrowing costs, delay a fundraising round, complicate a sale of the business and, in some cases, prompt a share price fall, because it signals that management cannot fully vouch for its own numbers. In practice, deficiencies are logged in a management letter after an audit, then tracked in a remediation plan with a named owner and a completion date.
Good finance teams retest the fixed control in the following period rather than treating the plan itself as evidence that the problem is solved. A useful nuance is that a deficiency can exist without any error having occurred yet, and an error can occur without there being a deficiency.
Compensating controls, meaning a different check that would catch the same problem, can reduce the severity rating even when the original control is genuinely broken.
In practice
Real-world examples.
Example
A retailer discovers that three former employees still have active logins to the payroll system four months after leaving. No fraudulent payment has occurred, but the auditor records an operating deficiency in user access management and asks for a quarterly access review.
Example
A manufacturer's purchasing policy requires two quotes for any order above $50,000, a threshold set a decade ago when the business was a tenth of its current size. Because almost no order now falls below it, the control adds delay without adding protection, and the auditor flags a design deficiency.
Example
A charity's finance officer both raises payment runs and holds the second authorisation token, because the other approver is often travelling. The auditor grades this as a significant deficiency in segregation of duties and recommends a named deputy approver.
Think of it
“Control deficiency is a flaw in your control system-something that might let errors through.
Case study
Seen in the real world.
This is an illustrative and entirely fictional example. Kestrel Medical Supplies, an invented distributor with revenue of about $60 million, had grown quickly and still ran its supplier master file the way it had at a quarter of the size: any of eleven staff could add or amend a supplier's bank details, and nobody reviewed the changes.
The external auditor raised it as a significant deficiency two years running. Both times management noted it and moved on, because no loss had ever occurred and the team was busy with a system migration. In the third year a convincing email prompted a clerk to change the bank details of a genuine supplier, and $140,000 left the account before the real supplier chased its invoice.
The fictional aftermath was instructive. Kestrel introduced a two person check on all bank detail changes and a callback to a number held on file, and the deficiency was closed at the next audit. The finance director's own summary was that the control had cost nothing to implement and the delay in implementing it had cost $140,000.
Watch out
Common mistakes.
- Assuming that because no loss has occurred, the control is working; absence of harm is not evidence of an effective control.
- Treating a written policy as the control itself, when the control is the act of someone actually performing and evidencing the check.
- Closing a deficiency on the strength of a remediation plan rather than retesting the control in a later period.
Questions
People also ask.
What is the difference between a significant deficiency and a material weakness?
Both are serious, but a material weakness means a material misstatement could realistically go undetected, which is the threshold that triggers public disclosure for listed companies.
Do small private companies need to care about control deficiencies?
Yes, because lenders, insurers and prospective buyers ask about them during due diligence, and small firms are the most exposed to fraud through weak segregation of duties.
Can a compensating control fix a deficiency?
It can reduce the severity rating by catching the same problem another way, but it does not remove the original weakness and should not be treated as a permanent answer.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%