Material Weakness

Control problems vary in size. Many are minor, some are important enough to bring to the audit committee, and a few are severe. In the US framework, deficiencies are graded into three levels: control deficiency, significant deficiency and material weakness. A significant deficiency is less severe than a material weakness but still merits attention from those overseeing financial reporting. A material weakness must be disclosed publicly by listed companies, and management then cannot conclude that its controls over financial reporting are effective. The grading looks at whether there is a reasonable possibility of a misstatement, and how large it could be, not at whether an error has happened. Compensating controls can lower a rating if they work. Similar grading is used in other countries and by internal audit teams, using their own wording. Disclosure of one can shake confidence in management and move the share price.

At one company the quarter-end process lets one accountant create and approve manual revenue adjustments, and no one reviews them. Several large adjustments occur each quarter. Auditors conclude that a material misstatement could go undetected, rate the gap a material weakness, and the company reports it in its annual filing along with its plan to fix it.