What does significant deficiency mean on the CPA exam?
Last reviewed
Significant deficiency. A deficiency, or combination of deficiencies, less severe than a material weakness but important enough to merit attention by those charged with governance. One can exist even though no misstatement was found.
Defined against AU-C 265.07, .A6.
Worked example
At a small distributor, one bookkeeper opens the mail, records customer receipts, makes the bank deposits and prepares the monthly bank reconciliation. The owner reads the bank statements each month but never sees the reconciliation. The auditor's testing finds no misstatement, and given the owner's review and the size of the accounts involved, judges that there is no reasonable possibility of it letting a material misstatement go unprevented or undetected, but that it is serious enough that those charged with governance should hear about it.
How does the auditor classify the deficiency, and what must be done about it?
- Combining custody of cash, recording and reconciliation in one person is a deficiency in internal control whether or not anything has gone wrong yet.
- Because a material misstatement is not a reasonable possibility here, it falls short of a material weakness. It still matters enough that governance should know about it, which makes it a significant deficiency.
- Significant deficiencies go to management and those charged with governance in writing; an oral mention does not satisfy the requirement.
Answer: A significant deficiency, communicated in writing to management and to those charged with governance, even though no misstatement was found.
The trap: Concluding there is nothing to report because the testing turned up no errors. A deficiency is judged on what the control fails to prevent or detect, not on whether a misstatement happened to occur this year.
Based on AU-C 265.07; AU-C 265.11.
Which CPA exam sections use significant deficiency?
Significant deficiency appears in the AUD section of the CPA exam.
What is the difference between significant deficiency and material weakness?
Both are deficiencies in internal control OVER FINANCIAL REPORTING and the difference is severity. A material weakness is severe enough that there is a reasonable possibility a material misstatement will not be prevented, or detected and corrected, on a timely basis, where reasonable possibility means more than remote. A significant deficiency is less severe than that yet important enough to merit the attention of those charged with governance. Both go in writing to those charged with governance, including any remediated during the audit, and both also go in writing to management. A deficiency that is neither is still reported to management, in writing or orally, when it merits management’s attention, and an oral communication has to be documented. (AU-C 265.07 and AU-C 265.12)
Other terms defined against AU-C 265
- material weakness: A deficiency, or combination of deficiencies, in internal control over financial reporting where there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis.
- reasonable possibility: More than remote.
Related terms
- control environment: The governance and management functions and the attitudes, awareness, and actions of those charged with governance and management concerning the entity's system of internal control.
- significant risk: A risk of material misstatement that warrants special audit attention because of its likelihood or its size.
- internal audit: An in-house function that evaluates controls and processes and reports to those charged with governance.
- senior management: The people who direct and control the entity day to day, as distinct from those charged with governance, whose job is to oversee them.
- those charged with governance: The people responsible for overseeing the entity's strategic direction and its accountability, including the financial reporting process.
- assessed risk: The auditor's judgment about the risk of material misstatement at the assertion level, combining inherent and control risk.