An auditor may identify control failures even when the financial statements require no adjustment and management reports no losses. Classification determines which matters require communication, who receives them, and whether an oral discussion must become a written letter.
A design deficiency exists when a necessary control is absent or would fail its objective even if performed correctly. An operating deficiency exists when a suitable control fails in practice, including performance by someone lacking the necessary competence or authority.
The auditor assesses potential misstatement magnitude and likelihood, considering deficiencies individually and together before communicating a classification to management. A reasonable possibility includes reasonably possible and probable outcomes; it does not require certainty or an actual misstatement.
The severity assessment addresses these questions:
- Which accounts, disclosures, and reporting assertions could be affected, and how large could the resulting misstatement become?
- Could the failure recur, permit fraud, or affect multiple transactions before another control identifies and corrects the problem?
- Do related failures affect the same process or control objective, creating a combined exposure greater than their separate descriptions suggest?
Common mistakes
- Arithmetic replaces judgment. Multiplying disbursements by an unsupported 2% cannot establish potential exposure; the control failure and supported likelihood must drive classification.
- Correction erases the finding. Correcting the specimen's $240,000 error does not repair its missing cutoff review or remove the communication obligation.
- Prior notice becomes permanent exemption. Last year's letter does not satisfy this year's obligation for an unresolved significant deficiency or material weakness.
Bottom line
- Material weakness requires a reasonable possibility that a material misstatement will escape timely prevention or timely detection and correction.
- Significant deficiency depends on importance to governance, with severity below a material weakness.
- Severity considers potential magnitude, likelihood, combined deficiencies, and supported compensating controls.
- Nonissuer significant deficiencies and material weaknesses require timely written communication to management and governance, no later than 60 days after report release.
Exam shortcut
The engagement category comes first: nonissuer financial statement audit, issuer financial-statement-only audit, or issuer integrated audit. Classification then determines recipients and form. A compensating review's title carries little weight unless the facts establish what it detects, when correction occurs, and whether it operated effectively. A deadline calculation uses the supplied report release or issuance event.
The full lesson (about 3,761 words, 25 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- I.F2
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.