Material weakness vs significant deficiency: where the line is

The two terms get used as though the choice between them were a drafting question. It is not.

One of them goes in the annual report and ends any possibility of calling internal control over financial reporting effective. The other generally does not appear there at all. Same broken control, very different filing.

Here is where the line sits, and what each side obliges you to do.

Three rungs, not two

The bottom rung is the plain fact that a control did not work — missing, poorly designed, or not operating as designed. Nothing much follows from that on its own.

Above it sit the two terms people fight over, both defined in Rule 12b-2 under the Exchange Act. A material weakness is:

"a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis."

A significant deficiency is:

"a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant's financial reporting."

Notice what the second definition does: it sets its ceiling by reference to the first, then adds a condition of its own — the matter must also be important enough to merit the attention of the people who oversee financial reporting. Release 33-8829, which adopted the significant deficiency definition effective 10 September 2007, says:

"Unlike the definition of the term 'material weakness,' we did not believe it was necessary for the proposed definition of 'significant deficiency' to include a likelihood component."

So the two tests are not a single sliding scale. Severity is still where the argument starts: is there a reasonable possibility of a material misstatement going unprevented and undetected?

Severity means likelihood and magnitude

The SEC's interpretive guidance for management, Release 33-8810, breaks that question into two factors: whether there is a reasonable possibility that internal control over financial reporting will fail to prevent or detect a misstatement, "and the magnitude of the potential misstatement."

Likelihood and magnitude. Both have to be considered, and a finding can be severe on one and mild on the other.

"Reasonable possibility" is not a casual phrase, either. The same release says what it means:

"There is a reasonable possibility of an event when the likelihood of the event is either 'reasonably possible' or 'probable'"

That is a lower bar than most people assume. It does not mean likely.

Two more points from the same release get skipped. The assessment is not purely arithmetic: "The evaluation of the severity of a control deficiency should include both quantitative and qualitative factors." And other controls count in your favour: "Management should evaluate the effect of compensating controls when determining whether a control deficiency or combination of deficiencies is a material weakness."

Deficiencies add up

Both definitions open the same way: "a deficiency, or a combination of deficiencies."

In our view this is the most-missed feature of the framework, and Release 33-8810 says where the adding up happens:

"Therefore, management should evaluate individual control deficiencies that affect the same financial statement amount or disclosure, or component of internal control, to determine whether they collectively result in a material weakness."

That is the sentence to read before deciding that a list of small findings is a list of small problems. A deficiency log is not a safe place to park things.

The IT layer tends to drive the outcome here: a weak access review, an unapproved change and a shared administrator account bear on every control that depends on those systems. Which ITGCs get looked at first is covered in the ITGC scoping article.

The situations that put a material weakness on the table

Release 33-8810 is interpretive guidance rather than a rule — Rule 13a-15(c) says an evaluation conducted in accordance with the guidance the Commission issued in Release No. 34-55929 "will satisfy the evaluation required by this paragraph." Within it, the Commission sets out situations management should evaluate:

"Management should evaluate whether the following situations indicate a deficiency in ICFR exists and, if so, whether it represents a material weakness:"

• "Identification of fraud, whether or not material, on the part of senior management"
• "Restatement of previously issued financial statements to reflect the correction of a material misstatement"
• "Identification of a material misstatement of the financial statements in the current period in circumstances that indicate the misstatement would not have been detected by the company's ICFR"
• "Ineffective oversight of the company's external financial reporting and internal control over financial reporting by the company's audit committee"

Note the first one: fraud by senior management counts whether or not material. The last one names the audit committee, and no process owner can remediate that.

The same release also offers a plainer touchstone — "the level of detail and degree of assurance that would satisfy prudent officials in the conduct of their own affairs." Worth returning to when a classification debate has gone deep into technique.

What each label costs you

A material weakness is a disclosure and a conclusion. Item 308(a)(3) of Regulation S-K is direct on both counts: "Management is not permitted to conclude that the registrant's internal control over financial reporting is effective if there are one or more material weaknesses," and "This discussion must include disclosure of any material weakness in the registrant's internal control over financial reporting identified by management."

There is no partial credit either. Question 5 of the staff's 2004 FAQ says management may not state that controls and procedures are effective "except to the extent that certain problems have been identified or express similar qualified conclusions." On wording, Question 20 says the Commission's rule does not require management to use any specific language in their report, but:

the staff would generally expect that, in order for management to provide full disclosure relating to any material weakness identified by management, management would use the term "material weakness" in their disclosures.

A significant deficiency is a governance obligation, not a public one.

That is not the same as keeping them quiet internally. Section 302 of Sarbanes-Oxley, codified at 15 U.S.C. § 7241, requires the signing officers to certify that they have disclosed to the issuer's auditors and the audit committee all significant deficiencies in the design or operation of internal controls which could adversely affect the ability to record, process, summarise and report financial data, and have identified for the auditors any material weaknesses.

So the practical difference is audience. A material weakness goes to the market. A significant deficiency goes to your auditor and your audit committee.

The timing problem nobody plans for

Management's annual conclusion is made as of the end of each fiscal year, under Rule 13a-15(c). That makes remediation useful — but only if the fixed control has operated long enough to be tested, which is why a late discovery lands badly.

Remediation is not invisible, either. Item 308(c) requires disclosure of any change in internal control over financial reporting identified in connection with the quarterly evaluation under Rule 13a-15(d) "that has materially affected, or is reasonably likely to materially affect, the registrant's internal control over financial reporting." The 2004 FAQ makes the same point: material changes made to controls in response to a significant deficiency are disclosable even where the deficiency itself is not.

And Instruction 2 to Item 308 requires the registrant to "maintain evidential matter, including documentation, to provide reasonable support for management's assessment." A classification you cannot evidence is not a classification; it is a position.

How these arguments usually go wrong

A few patterns we would flag, as this publication's view:

• The deficiency is described too vaguely to classify. "Access reviews were inconsistent" cannot be assessed for magnitude. Which systems, which accounts, which periods, and which financial statement lines depend on them.
• The label is picked first and justified afterwards. The order matters. Likelihood and magnitude, then the name.
• Compensating controls are claimed, not tested. A compensating control only reduces severity if it operated and you can show it.
• Nobody aggregates. See above. The combination clause is in both definitions for a reason.
• The conversation starts in the fourth quarter. Where an attestation report is in play — Item 308(b) requires accelerated and large accelerated filers that are not emerging growth companies to provide one in the annual report — a classification debate opened that late has nowhere to go. See 404(a) vs 404(b).

What to do with one you have found

1. Write the deficiency down precisely — the control, the system, the period, the accounts it touches, and how it was found.
2. Assess likelihood and magnitude separately, in writing, with quantitative and qualitative factors both addressed, before anyone proposes a label.
3. Group it against every other open finding that affects the same financial statement amount or disclosure, and reassess the combination.
4. Put it in front of the audit committee and the auditors now. The Section 302 certification will require that anyway, and early is cheaper than late.
5. Date the remediation plan against year-end, so the fixed control has operating history to test rather than a start date in December.

To work out how much runway the current year still gives you, the SOX 404 deadline calculator lays the milestones back from your year-end, and the readiness scorecard will show which gaps are still fixable. This is general information rather than audit or legal advice — confirm classification decisions and their disclosure consequences with your auditor or counsel.

Common questions

What is the actual difference between a material weakness and a significant deficiency?

Rule 12b-2 defines a material weakness as a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. The same rule defines a significant deficiency as less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant's financial reporting. So severity sets the ceiling, and the oversight-attention element is a second condition in its own right.

Can we still say our internal control is effective with a material weakness outstanding?

No. Item 308(a)(3) of Regulation S-K says management is not permitted to conclude that internal control over financial reporting is effective if there are one or more material weaknesses, and the discussion must disclose any material weakness management identified.

Who decides which one it is — us or the auditor?

Management reaches its own conclusion for the Item 308 report — Item 308(a)(3) does not permit a conclusion that internal control over financial reporting is effective if there are one or more material weaknesses. Where an attestation report is in play, Item 308(b) requires a registrant that is an accelerated filer or a large accelerated filer, other than an emerging growth company, to provide the registered public accounting firm's attestation report on internal control over financial reporting in that annual report. In our view that is why the classification is worth settling early rather than during fieldwork. Confirm the process with your auditor.

Does fixing the control before year-end make the problem go away?

It can change the year-end conclusion, because Rule 13a-15(c) has management evaluate effectiveness as of the end of each fiscal year — but a remediated control still has to have operated long enough to be tested, and a change that materially affected internal control during the last fiscal quarter is itself disclosable under Item 308(c).

Does a significant deficiency ever become a disclosure event?

Yes, in two ways the staff has described: if it combines with other deficiencies into a material weakness, or if the changes you make to controls in response are themselves material changes that have to be disclosed for the quarter in which they occurred.

Sources

1. 17 CFR 240.12b-2 — Definitions, including material weakness and significant deficiency · U.S. Government Publishing Office (Code of Federal Regulations)
2. 17 CFR 229.308 (Item 308 of Regulation S-K) — Internal control over financial reporting, with Instructions · U.S. Government Publishing Office (Code of Federal Regulations)
3. 17 CFR 240.13a-15 — Controls and procedures · U.S. Government Publishing Office (Code of Federal Regulations)
4. Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting (Release Nos. 33-8810; 34-55929), Federal Register, 27 June 2007 · U.S. Securities and Exchange Commission, via the Federal Register
5. Definition of the Term Significant Deficiency (Release Nos. 33-8829; 34-56203), Federal Register, 9 August 2007 · U.S. Securities and Exchange Commission, via the Federal Register
6. 15 U.S.C. § 7241 — Corporate responsibility for financial reports (Sarbanes-Oxley Act § 302) · U.S. Government Publishing Office (United States Code)
7. Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports — Frequently Asked Questions (revised 2004) · U.S. Securities and Exchange Commission, Office of the Chief Accountant and Division of Corporation Finance