Glossary term
Control Deficiency
Subject: Risk Management, Controls and Risk Treatment
Also known as: Control Gap, Control Weakness
A control deficiency exists when a control is missing, badly designed or not working as intended, so it cannot reliably stop or catch the risk it was meant to address.
Explanation
A deficiency can be one of two kinds. A design deficiency means the control, even if followed perfectly, would not deal with the risk, or no control exists at all, which people often call a control gap. An operating deficiency means the control is well designed but is not carried out properly, for example approvals are skipped or reviews are late. Deficiencies are usually rated by how likely they are to lead to a loss or misstatement and how large it could be. Minor ones are logged and fixed in the normal course. Serious ones are escalated to management and the audit committee, and in financial reporting terms may be called a significant deficiency or a material weakness. They come from audits, control testing and self-assessments. Auditors read the age of open deficiencies as a sign of whether management acts on findings.
Example
During testing, a bank's internal audit team finds that a report of overdue loan reviews is produced each month but nobody is assigned to act on it. The control is designed to catch late reviews, yet it has no owner. Audit rates it a design deficiency, agrees a named owner and a deadline with management, and tracks closure.
Not to be confused with
- Audit Finding
- A finding is the written result of an audit. A control deficiency is the underlying weakness, which may be one of many findings.