What it means
Internal controls are the everyday checks that keep the numbers honest: someone approves the invoice, someone else pays it, a third person reconciles the bank account. When one of those checks is missing, badly designed or simply not performed, auditors call it a control deficiency and then assess how bad it is.
The assessment turns on two questions. How likely is it that a misstatement slips through, and how big could that misstatement be if it did?
A deficiency becomes significant when the potential error is more than trivial but is unlikely to reach the level that would change an informed reader's view of the financial statements. The distinction matters because the reporting consequences differ sharply.
Material weaknesses must be disclosed publicly by listed companies and typically knock confidence and share price, while significant deficiencies are communicated privately in writing to the audit committee and management. For managers outside finance, the usual trigger is process rather than fraud.
Common causes include one person holding too many incompatible duties in a small team, spreadsheet controls that nobody reviews, access rights left switched on after someone changes role, or reconciliations performed but never signed off. Severity is also cumulative.
Several individually modest deficiencies affecting the same account or the same process can be aggregated by the auditor into a single material weakness, which is why finance teams take a cluster of small findings more seriously than a single isolated one. The correct response is a remediation plan with a named owner, a deadline and evidence that the new control actually operated for a period.
Auditors will not clear a finding on the strength of a policy document; they want to see the control running and leaving a trail.
In practice
Real-world examples.
Example
A software company's auditors find that three developers retained administrator access to the billing system after moving to a different team. No incorrect invoices were traced, but the access could have allowed unrecorded changes to revenue, so the finding is raised as a significant deficiency with a 60-day remediation deadline.
Example
A hospital group reconciles its patient revenue accounts monthly, but the reconciliations for four months were prepared and approved by the same accountant. The auditor concludes the self-review breaches segregation of duties, quantifies the exposure at well under materiality, and reports it to the audit committee.
Example
A retailer relies on a spreadsheet to calculate its inventory provision. The file has no version control and no independent review of the formulas, so a single mistyped rate could misstate the provision by a few hundred thousand dollars, which lands the finding squarely in significant deficiency territory.
Think of it
“Significant deficiency is a notable control problem-serious but not the worst.
Formula
Calculation
There is no formula in the arithmetic sense, but severity is judged against a materiality threshold, which auditors usually anchor to a percentage of pre-tax profit:
Overall materiality = benchmark profit x chosen percentage
Suppose a mid-sized distributor reports pre-tax income of $24 million and the auditor sets overall materiality at 5%: $24,000,000 x 0.05 = $1,200,000. The auditor then finds that purchase orders above $50,000 are approved by the requisitioner rather than a second manager, and estimates the maximum plausible misstatement from that gap at $400,000. Because $400,000 is only $400,000 / $1,200,000 = 33% of materiality, the error could not on its own distort the accounts, yet it is far from trivial. The finding is therefore reported as a significant deficiency; had the exposure been $1.5 million, above the $1.2 million threshold, it would have been escalated to a material weakness.Case study
Seen in the real world.
The following is an illustrative, fictional case. Bellcastle Instruments, a listed maker of laboratory equipment, reported pre-tax profit of $18 million, giving its auditors an overall materiality of $900,000 at a 5% benchmark.
During the year-end audit, three findings surfaced in the revenue process: sales credits under $25,000 required no second approval, the customer master file could be edited by two sales administrators, and the deferred revenue schedule was reviewed by the same analyst who prepared it. Individually the auditors estimated exposures of $150,000, $200,000 and $300,000, each comfortably under materiality.
Because all three sat in the same cycle, the audit partner aggregated them, reaching a combined exposure of $650,000. That total remained below the $900,000 threshold, so the findings were reported as significant deficiencies rather than a material weakness. Bellcastle's audit committee gave the controller one quarter to add a second approver, lock the master file and introduce independent review, and the following year's audit confirmed all three controls operating.
Watch out
Common mistakes.
- Treating a significant deficiency as proof that the reported numbers are wrong. It describes the possibility of an error slipping through, not the confirmed existence of one.
- Assuming the finding must be disclosed to the market. Significant deficiencies are reported in writing to management and the audit committee, whereas public disclosure is generally reserved for material weaknesses.
- Closing a finding by rewriting the policy. Remediation is only accepted once the redesigned control has demonstrably operated over a period and left evidence behind.
Questions
People also ask.
What is the difference between a significant deficiency and a material weakness?
Both are control failures, but a material weakness carries a reasonable possibility of a misstatement large enough to matter to investors, while a significant deficiency falls below that bar yet still warrants audit committee attention.
Can several significant deficiencies become a material weakness?
Yes, auditors aggregate related findings affecting the same account or process, so a group of moderate gaps can together cross the materiality threshold.
Who decides the severity rating?
The external auditor makes the formal call under the relevant auditing standards, though management performs its own assessment first and the two views are usually discussed before the finding is written up.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%