Whether a control problem is a deficiency, a significant deficiency, or a material weakness drives what you must disclose — and it's a judgment teams get wrong in both directions. This structures it.
What this tool does
You answer questions about the deficiency and the magnitude and likelihood of a resulting misstatement; it suggests a classification under PCAOB AS 2201 with the reasoning.
Who it's for
Controllers, CFOs, and audit-committee members assessing an identified control issue.
How to use it — step by step
- Describe the deficiency. What control failed and how.
- Assess magnitude. Could it lead to a material misstatement?
- Assess likelihood. Reasonable possibility of a misstatement going undetected?
- Read the classification. CD, SD, or MW — with the AS 2201 reasoning.
How to read your result
The dividing line is the reasonable possibility of a material misstatement. A detected-and-corrected error still counts if the control couldn't be relied on to catch it.
Worked examples
The same tool behaves differently depending on what you put in. Here are 3 situations.
Segregation-of-duties gap
Inputs: One person can initiate and record.
What the tool shows: Often a significant deficiency or material weakness depending on compensating controls and account size.
What to do: Assess compensating controls; document the conclusion.
A misstatement slipped through
Inputs: An error was found after the fact.
What the tool shows: Points toward material weakness if the control couldn't reasonably have caught it.
What to do: Don't understate it because it was corrected.
Management override
Inputs: A control was bypassed by leadership.
What the tool shows: Elevates severity — override is a serious indicator.
What to do: Treat seriously; involve the audit committee.
Common questions
What's the standard? PCAOB AS 2201 for ICFR severity classification.
Does a corrected error avoid a material weakness? Not necessarily — it's about whether the control could be relied on.
Does this replace your auditor? No — severity is a shared judgment; verify with your auditor.