Control weaknesses can be in the form of control deficiencies, significant deficiencies, or material weaknesses. Control deficiencies occur when a control is missing, poorly designed, does not operate as intended, or the controller is unqualified. Significant deficiencies are one or more control deficiencies that are not considered material weaknesses. Material weaknesses result in a possibility that financial statements could be misstated without timely detection. To identify weaknesses, existing controls must be identified and their absence considered along with potential compensating controls. The likelihood and materiality of a potential misstatement is assessed to determine if a significant deficiency or material weakness exists.

1. © OECD
A joint initiative of the OECD and the European Union, principally financed by the EU
Tirana, 10-12 September 2014
Workshop System Based Auditing
10 Defining weaknesses in controls

2. 2

3. 3

4. 10.1 Weaknesses in controls
•Control deficiency - control is missing or not good designed or does not operate as designed or controller is unqualified or unauthorised to perform control
•Significant deficiency – one or more control deficiencies exist but not material weakness
•Material weakness – significant deficiency results in possibility that IC will not prevent or detect timely misstatements in fin. statement
4

5. 10.2 Steps to identify weaknesses
•Identify existing controls
•Identify absence of key controls (risk control matrix)
•Consider possibility of compensating controls (to offset absence of key control)
•Decide whether there is a significant deficiency or material weakness (likely hood and materiality important)
•Determine potential misstatement that could result
5

6. 10.3 Next steps
•Associate control deficiencies with related audit objectives
•Assess control risk for each related objective
•Communicate significant deficiencies and weaknesses to management
-------------------------
•Test of controls
•Substantive testing
6

7. 7

8. QUESTIONS?
8