Significant deficiency as defined by, the Public Company Accounting Oversight Board (PCAOB, is a deficiency alone, or a combination of them, in internal control over financial reporting (ICFR) of the entity. However, it is less severe to the company than a material weakness on the financial reporting of the company. Yet, the weakness should also bring to BOD or those in charge of the company’s financial reporting.

On its own, a deficiency in the internal control system may not be classified as a significant deficiency. But if it is a group of deficiencies impacting the same account balance or disclosure, sometimes even an assertion, it could potentially raise the risk of a material misstatement, thereby resulting in what we call, a significant deficiency.

How to assess significant deficiencies?

In the first step, we need to determine which are the high-risk areas that deficiencies might appear. Here are some examples:

• Lack of proper risk assessments: Especially in the case when there is a change in the company’s business, such as business combination, a lack of regular risk assessment may result in the exposure of the company to new and unknown risk categories.
• Ineffective risk assessments: Risk assessments have been carried out but they are insufficient or ineffective in recognising the risk of material misstatement which the auditor would anticipate the risk assessments to recognise.
• Lack of corrective action: This will have a huge impact on the company financial statements and control environment when management fails to take appropriate corrective action to address the significant deficiencies previously communicated to them by the auditors.
• Ineffective response to known risks: This is when management has identified a significant risk but has failed to implement the right controls over them to lower the risk. This would render the assessment useless and expose the company to unnecessary risks.
• Incompetence or inexperienced management: Management is unable to prepare the full set of financial statements that adhere to the applicable accounting standards, laws and regulations due to lack of experience or simply is not equipped with the necessary knowledge to do so.
• Prior year restatements: A restatement of financial statements issued in the prior financial years are one of the signs that control deficiencies may have occurred.
• Discovery of fraud: If any fraud is reported, regardless of whether it is material or not, it tells us that the company’s internal control is inadequate in preventing such fraudulent activities from happening.
• Lack of review procedures: The lack of such a control procedure can result in material errors as the risks may not be properly addressed. This is especially prominent in material transactions that the preparer may financially interested in.

After identifying a control deficiency, next, we will evaluate its significance and decide if it can be called a significant deficiency. There are many elements to consider when determining the extent of an identified control deficiency.

In this article, we will split the factors to consider into quantitative and qualitative criteria when determining whether a deficiency in internal control is a significant deficiency. Once identified, we will be able to determine if there is any potential misstatement in the financial statement.

First, let’s look at quantitative factors as they are more straightforward. Quantitative factors can help us assess to what extent a potential misstatement would be material. The following are some of these factors:

• Is the amount affected by the deficiencies material to the financial statements?
• What is the total amount of activities in the account balance that is affected by the deficiencies that have happened or are likely to happen in the future?
• What are the sums in the financial statements or the total number of transactions affected by the deficiencies?

It is important to take note that, there will be times when we can’t quantify all control deficiencies into an amount of misstatement in the financial statements. This is where the qualitative factors come in.

A deficiency in internal control may be identified as a significant deficiency based on certain qualitative factors if it is perceived by the users of the financial statements to bring significant consequences. Qualitative factors may cause a deficiency to be recognised as a significant deficiency even if its amount is less than the materiality threshold. Here are some of the qualitative factors to consider:

• What is the nature of the accounts and disclosures in the financial statement?
• What are the relevant assertions?
• What are the complexity and the degree of judgement required when calculating the accounting estimates, such as the pension and warranty expenses?
• What has caused the deficiencies to happen?
• How frequently are the deficiencies are occurring?
• What is the significance of the affected controls to the company’s financial reporting process?
• Are there any mitigating controls? If there are, these mitigating controls must be operating effectively in terms of preventing and detecting a material misstatement. Tests of control will need to be performed on those mitigating controls to ensure their operational effectiveness. When testing the mitigating controls, we treat them as if we are testing the normal controls. If any deficiencies are discovered, we should report those deficiencies to the management too.
• Will the deficiency result in a higher susceptibility to fraud or loss of assets?
• What is the possibility that the deficiencies may lead to future material misstatements in the financial statements?
• What are the associated or relevant controls that might be affected? Points to further evaluate include whether the deficiency will cause the other controls to not operate effectively.
• What is the impact on the transactional level or the company level controls?
• Will this warrant the attention of those charged with governance?

In summary, significant deficiencies that exist in the design or operation of ICFR may adversely affect the company’s ability to summarise, record, process, and report financial information. This will prevent the financial statements from being stated truly and fairly and will impact the audit results during the annual audits.

It is, therefore, prevalent for the company to ensure it has performed the necessary checks and assessments to address those deficiencies and lower the risks to the businesses.