Material weakness — Modern Auditing

The most severe classification of internal control deficiency — one where there is a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis.

Deficiencies are graded in three tiers. A control deficiency exists when a control does not allow management or employees to prevent or detect misstatements on a timely basis. A significant deficiency is less severe than a material weakness but important enough to merit attention by those responsible for financial reporting oversight. A material weakness carries a reasonable possibility that a material misstatement of the financial statements would not be prevented or detected on a timely basis.

Two points auditors get wrong regularly. First, severity is about potential magnitude, not what actually happened — a deficiency with no observed error can still be a material weakness if the exposure is there. Second, deficiencies aggregate: several individually minor issues affecting the same account or assertion can combine into something more severe, which is why classification cannot be done deficiency-by-deficiency in isolation.

ITGC failures escalate faster than most, because a single access or change-management failure can undermine every automated control in the affected system at once.