Control deficiency, significant deficiency, or material weakness?
Classify an internal-control deficiency by likelihood and magnitude, then apply the correct issuer or nonissuer communication rules.
The decision that earns the point
Identify the engagement facts and governing framework
A control deficiency exists when a control's design or operation does not allow timely prevention or detection of misstatements. A significant deficiency is less severe than a material weakness but important enough to merit audit-committee attention. A material weakness creates a reasonable possibility that a material financial statement misstatement will not be prevented or detected on a timely basis.
Exam use
AUD can test design versus operating deficiency, likelihood and potential magnitude, aggregation of deficiencies, compensating controls, indicators of material weakness, and communication timing. An actual misstatement can be evidence of severity, but classification depends on potential exposure and likelihood, not on the detected amount alone.
Your scratch-paper plan
Solve it in three moves
- 1
Prove that a control deficiency exists
Identify the failed control objective and whether design or operation could allow a misstatement to escape timely prevention or detection.
PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting - 2
Assess likelihood and potential magnitude
Consider susceptible account size, possible future misstatement, volume, subjectivity, aggregation, and compensating controls rather than using the found error as the ceiling.
PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting - 3
Apply the framework-specific communication
For the issuer illustration, communicate material weaknesses and significant deficiencies in writing to management and the audit committee before report issuance; use current AU-C 265 for a nonissuer.
PCAOB AS 1305: Communications About Control Deficiencies in an Audit of Financial Statements
Worked problem
Work the facts before choosing the answer
In a PCAOB integrated audit, a senior manager can post and approve manual revenue entries without an effective independent review. The affected population could exceed overall materiality, and testing finds one material year-end entry with fabricated support that the control did not prevent or detect.
CPAPass exam analysis using the stated assumptions
Show the work
The design permits unauthorized material revenue entries and there is a reasonable possibility that a material misstatement would not be prevented or detected timely. The actual material entry supports, but does not alone define, the severity assessment.
Rule source: PCAOB AS 2201: An Audit of Internal Control Over Financial ReportingAnswer
Classify the issue as a material weakness for the issuer facts, evaluate its effect on the ICFR opinion and financial statement audit, and communicate it in writing to management and the audit committee before report issuance.
Rule source: PCAOB AS 2201: An Audit of Internal Control Over Financial ReportingDo it now
Test the same decision with a fresh question
Start with free AUD practice. Create an account only when you want the 5-day no-card CPAPass trial and continued section practice.
The trap and the repair
Common trap
Comparing only the error found with materiality treats detected amount as the maximum possible misstatement and ignores likelihood, exposure, aggregation, and compensating controls.
Repair
Estimate what could reasonably pass through the failed control, then assess likelihood and magnitude before choosing the label.
Authority and scope boundary
PCAOB AS 2201 controls the issuer severity definitions and integrated-audit conclusion; PCAOB AS 1305 controls financial-statement-audit deficiency communication for an issuer. Current AU-C 265 is the separate nonissuer authority and does not create a PCAOB ICFR opinion. COSO framework design belongs to its existing owner.
2026 Uniform CPA Examination Blueprints and PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting were reviewed on 2026-08-14. Check a newer authority when the effective date or facts change.
Severity matrix
Classify the exposure, not merely the error already found
The severity decision moves from failed control objective to likelihood, potential magnitude, compensating controls, and required communication.
| Classification | Severity test | Issuer consequence | Authority |
|---|---|---|---|
| Control deficiency | The design or operation does not allow timely prevention or detection of misstatement | Evaluate severity and communicate under the applicable PCAOB requirement | PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting |
| Significant deficiency | Less severe than a material weakness but important enough to merit audit-committee attention | Written communication to management and audit committee before report issuance | PCAOB AS 1305: Communications About Control Deficiencies in an Audit of Financial Statements |
| Material weakness | Reasonable possibility that a material misstatement will not be prevented or detected timely | Adverse ICFR opinion in an integrated audit, plus required written communication | PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting |
| Nonissuer audit | Apply current AU-C 265 definitions and communication requirements to the nonissuer facts | No PCAOB integrated-audit opinion unless another requirement separately applies | AICPA Statements on Auditing Standards currently effective for nonissuer audits |
After a miss
Repair a deficiency-severity miss
- 1
Write failed objective, reasonable likelihood, possible magnitude, and compensating control as four separate findings.
- 2
Rework the illustration after adding an effective independent review that detects every manual entry before posting and reassess whether a deficiency remains.
- 3
Answer a fresh AUD control question and state classification, supporting facts, recipient, form, timing, and opinion effect.
Your exam workflow
- Step 1Identify the requirementIdentify the failed control objective and whether design or operation could allow a misstatement to escape timely prevention or detection.PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting
- Step 2Classify the factsConsider susceptible account size, possible future misstatement, volume, subjectivity, aggregation, and compensating controls rather than using the found error as the ceiling.PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting
- Step 3Apply the authorityFor the issuer illustration, communicate material weaknesses and significant deficiencies in writing to management and the audit committee before report issuance; use current AU-C 265 for a nonissuer.PCAOB AS 1305: Communications About Control Deficiencies in an Audit of Financial Statements
- Step 4Check the outputClassify the issue as a material weakness for the issuer facts, evaluate its effect on the ICFR opinion and financial statement audit, and communicate it in writing to management and the audit committee before report issuance.PCAOB AS 2201: An Audit of Internal Control Over Financial Reporting
Keep the next step narrow
Quick questions
What is the key rule?
A control deficiency exists when a control's design or operation does not allow timely prevention or detection of misstatements. A significant deficiency is less severe than a material weakness but important enough to merit audit-committee attention. A material weakness creates a reasonable possibility that a material financial statement misstatement will not be prevented or detected on a timely basis.
How can this topic be tested on the CPA Exam?
AUD can test design versus operating deficiency, likelihood and potential magnitude, aggregation of deficiencies, compensating controls, indicators of material weakness, and communication timing. An actual misstatement can be evidence of severity, but classification depends on potential exposure and likelihood, not on the detected amount alone.
What mistake most often changes the result?
Comparing only the error found with materiality treats detected amount as the maximum possible misstatement and ignores likelihood, exposure, aggregation, and compensating controls. Estimate what could reasonably pass through the failed control, then assess likelihood and magnitude before choosing the label.
Where should I practice the decision?
After the worked example, open the AUD free-practice link and work a fresh question that tests the same decision. If the miss depends on Internal-control testing in AUD, review that handoff before trying another set.