What is a Significant Deficiency?
A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting. It must be reported in writing to the audit committee but not disclosed publicly.
- A significant deficiency is an ICFR deficiency, or combination of deficiencies, less severe than a material weakness yet important enough to merit the audit committee's attention (PCAOB AS 2201, SEC Regulation S-X).
- It is the middle rung of the three-level scale: deficiency, significant deficiency, material weakness.
- It does not change the auditor's ICFR opinion and is not disclosed in the 10-K, but the auditor must report it in writing to the audit committee and officers must disclose it under their Section 302 certifications.
- Severity turns on the likelihood and magnitude of misstatement, with compensating controls taken into account.
- Deficiencies are evaluated individually and in combination; several minor ones sharing an account, assertion or root cause can aggregate into a significant deficiency or a material weakness.
What is a Significant Deficiency?
A significant deficiency is a deficiency, or combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness yet important enough to merit attention by those overseeing financial reporting.
PCAOB AS 2201 (Appendix A, paragraph A11) and SEC Regulation S-X Rule 1-02(a)(4) use the same wording. The term is the middle rung of the deficiency scale. A significant deficiency does not change the auditor's opinion on ICFR and is not disclosed in the annual report, but the auditor must communicate it in writing to the audit committee, and the Section 302 certifications require the CEO and CFO to disclose all significant deficiencies and material weaknesses to the auditor and the audit committee.
Why it matters
- It is the audit committee's early warning. A significant deficiency left open can combine with others into a material weakness.
- It shapes the remediation queue. Companies typically fix significant deficiencies before the next year-end test cycle to avoid escalation.
- It affects certifications. Officers sign quarterly that they have disclosed every significant deficiency to the auditor and the audit committee.
How severity is judged
The same two tests apply to every deficiency: the likelihood that it results in a misstatement and the magnitude of that misstatement. A deficiency whose potential misstatement is more than inconsequential but less than material, or whose likelihood is remote for a material amount but the matter is important to oversight, usually lands as a significant deficiency. Compensating controls that operate at a level of precision sufficient to catch the error can reduce the rating.
Aggregation
Deficiencies are evaluated individually and in combination. Several individually minor deficiencies that affect the same account, assertion or process, or that share a root cause such as a weak control environment, may together amount to a significant deficiency or a material weakness. This is why deficiency logs record the account, assertion and root cause for every item.
Reporting obligations
- Auditor to audit committee: written communication of all significant deficiencies and material weaknesses (AS 2201 paragraph 80).
- Management to auditor and audit committee: disclosure under the Section 302 certification.
- Public disclosure: not required for a significant deficiency, although some companies choose to describe remediation in their filings.
Related terms
- Internal control over financial reporting (ICFR)
- SOX deficiency management
- SOX remediation and retesting
- SOX control testing
- Internal control management
- SOX compliance
In SmartSuite
SmartSuite SOX Management keeps a deficiency log with the likelihood and magnitude assessment, compensating controls, aggregation notes and the audit committee report date, so the severity conclusion for each item is documented and the combined view is always current.
Frequently asked questions
What is the difference between a significant deficiency and a material weakness?
Both are deficiencies in ICFR. A material weakness carries a reasonable possibility of a material misstatement going undetected and must be disclosed publicly with an adverse ICFR opinion. A significant deficiency is less severe, stays between management, the auditor and the audit committee, and does not affect the opinion.
Does a significant deficiency have to be disclosed in the 10-K?
No. Public disclosure is required only for material weaknesses. However, the CEO and CFO must disclose all significant deficiencies to the external auditor and the audit committee under their Section 302 certifications, and the auditor must report them in writing to the audit committee.
Can several small deficiencies become a significant deficiency?
Yes. Deficiencies are assessed individually and in combination. Related deficiencies in the same process, account or assertion, or deficiencies with a common cause, can aggregate to a significant deficiency or a material weakness even though each one alone would be rated as a simple deficiency.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.