A material weakness, according to the Public Company Accounting Oversight Board (“PCAOB”), is a deficiency, or a group of deficiencies, in a company’s internal control over financial reporting (“ICFR”), that makes it reasonably likely that a material misstatement cannot be avoided or identified in the financial statements of the company promptly.

Deficiencies in one or more of a company’s internal controls are frequently the source of a material weakness.

Often, there is no one reason for the material weakness but rather a collection of control deficiencies that result in a material error in the financial statements.

The risk caused by controls not being adequately designed or working effectively is also considerably higher for companies going through many changes or growing fast.

If a material weakness is found, it can harm a company’s stock price and credit rating and a loss of investor trust, and cause expensive audits. Hence, companies should seek to avoid such internal control deficiencies.

How do You Assess Material Weaknesses?

Companies can reduce the risks that cause material weaknesses by understanding the circumstances where such deficiencies emerge and the trends in material weaknesses.

There are a few typical circumstances that put a company’s ICFR at risk:

1) When adopting new accounting standards

A company usually faces several control risks when adopting a new accounting standard. It should design the necessary controls and procedures and ensure adequate controls are in place for the adoption.

The controls developed must support the accounting conclusions and minimize the risk of any material misstatement.

As the adoption window given is usually quite short, it is not uncommon for most companies to ignore these types of controls, especially those with large amounts of data.

2) When key accounting and finance personnel resign

The control environment might be temporarily compromised as a result of their resignations. If it is so unfortunate that some ongoing transactions are as significant as a merger and acquisition, the problems may be worsened.

Lack of resources and the need to handle complex accounting and financial reporting issues that arise from these transactions in a short timeframe increases a company’s risk of exposure to material weaknesses.

Therefore, there should be proper procedures to ensure knowledge transfer when turnover occurs. This also addresses the issue of accountability for transferred duties.

3) When accuracy and completeness are ignored

During an external audit, auditors will always verify the accuracy and completeness of reports and data used to implement critical controls.

A report extracted from a system is not always enough to establish the control’s accuracy, completeness, or effectiveness.

Regular validation processes should be carried out to verify that all customizable reports are populated with the correct data using consistent queries.

Further validation processes will be required if the control involves editable files like an Excel workbook. The company should properly document all these validations performed.

4) When new technology is introduced

Change management, particularly when introducing new technology, may be difficult for companies to traverse.

Change management controls related to introducing new technology may cause material weaknesses when these controls fail to maintain data integrity during the transition stage.

Such data integrity concerns may damage a company’s control environment, and if not handled properly, it may even damage its reputation.

To lower the risk, companies should proactively implement a change management strategy that includes controls designed to maintain data integrity, such as cross-system reconciliations during the parallel-run phase.

Now that we know the circumstances that may cause a material weakness to arise, here are some common examples of high-risk areas to focus on:

• Lack of proper risk assessments: Especially when there is a change in the company’s business, such as a business combination, a lack of regular risk assessment may result in the company’s exposure to new and unknown risk categories.
• Over-reliance on third parties or accounting system: Some examples include the use of accounting system that does not have features such as audit logs or third-party services that do not offer Type II reports.
• Lack of review procedures: The lack of such a control procedure can result in material errors as the risks may not be properly addressed. This is especially prominent in complicated accounting areas requiring much judgment.
• Lack of segregation of duties: An example includes individual employees who execute incompatible activities, such as a purchase manager who approves his or her purchase requisitions.

All these high-risk areas can cause a material error in the financial statements to be reasonably likely not be identified promptly, resulting in a material weakness.

So now, what are some of the important criteria to consider to make sure what is detected is a material weakness? Here are some guidelines:

• What is the extent of the possible misstatement due to the control deficiency? For instance, the total monthly transaction amounts involved.
• Is the control deficiency material enough to warrant the attention of those in charge of the company’s financial reporting?
• Is there any sign of material weakness? For example, the audit committee’s poor monitoring of the company’s ICFR or the detection of fraud.
• What risk considerations are made on the associated controls, the type of the account, and their potential consequences?
• Would the deficiency prevent the company’s financial statements from complying with the relevant accounting standards or laws and regulations?
• Is there any well-functioning mitigating control to reduce the risk of a potential misstatement?
• Is it reasonably likely that the controls fail to prevent a material error in the financial statements?

Knowing all these common risk areas will allow us to detect a potential material weakness earlier. The earlier a potential material weakness is detected, the faster it can be corrected, and the better it will look for the company.