A Framework for Evaluating

Control Exceptions and Deficiencies

Version 3

December 20, 2004

 Table of Contents

Page

Introduction and Purpose 1

Guiding Principles 3

Terminology 14

Chart 1 – Evaluating Exceptions Found in the 17

Testing of Operating Effectiveness

Chart 2 – Evaluating Process/Transaction-Level 18

Control Deficiencies

Chart 3 – Evaluating Information Technology General 19

Control (ITGC) Deficiencies

Chart 4 – Evaluating Deficiencies in Pervasive Controls 20

Other than ITGC
 Introduction and Purpose
This paper outlines a suggested framework for evaluating exceptions and deficiencies
resulting from the evaluation of a company’s internal control over financial reporting.
Issuers and auditors may find this framework useful.

This paper should be read in conjunction with Auditing Standard No. 2, An Audit of
Internal Control Over Financial Reporting Performed in Conjunction With an Audit of
Financial Statements (AS 2), especially the definitions in paragraphs 8 through 10, the
section on evaluating deficiencies in paragraphs 130 through 141, the examples of
significant deficiencies and material weaknesses in Appendix D, and the Background and
Basis for Conclusions in Appendix E. The framework is not a substitute for AS 2 and
other relevant professional literature.

The framework was developed by representatives of the following nine firms:

BDO Seidman LLP

Crowe Chizek and Company LLC
Deloitte & Touche LLP
Ernst & Young LLP
Grant Thornton LLP
Harbinger PLC
KPMG LLP
McGladrey & Pullen LLP
PricewaterhouseCoopers LLP

In addition, William F. Messier, Jr., Professor, Georgia State University, also contributed
to the development of the framework.

This framework reflects their views on a framework consistent with their understanding
of AS 2.

The framework represents a thought process that will require significant judgment. The
objective of the framework is to assist knowledgeable and experienced individuals in
evaluating deficiencies in a consistent manner. The mere mechanical application of this
framework will not, in and of itself, necessarily lead to an appropriate conclusion.
Because of the need to apply judgment and to consider and weigh quantitative and
qualitative factors, different individuals evaluating similar fact patterns may reach
different conclusions.

The framework recognizes the requirement in AS 2 to consider likelihood and magnitude

in evaluating deficiencies. It also recognizes that AS 2.136 states:

In evaluating the magnitude of the potential misstatement, the auditor should

recognize that the maximum amount that an account balance or total of transactions
can be overstated is generally the recorded amount. However, the recorded amount is
not a limitation on the amount of potential understatement. The auditor also should

1
 recognize that the risk of misstatement might be different for the maximum possible
misstatement than for lesser possible amounts.

The framework applies these concepts through the evaluation of a combination of

magnitude and likelihood. Because of the wide variety of control types, population
characteristics, and test exception implications, the group did not undertake to develop a
purely quantitative model. Instead, the framework considers quantitative and qualitative
factors.

This paper does not address the determination of materiality. Reference, in that regard,
should be made to AS 2.23, which states:

The same conceptual definition of materiality that applies to financial reporting applies
to information on internal control over financial reporting, including the relevance of
both quantitative and qualitative considerations.*

o The quantitative considerations are essentially the same as in an audit of

financial statements and relate to whether misstatements that would not be
prevented or detected by internal control over financial reporting, individually
or collectively, have a quantitatively material effect on the financial statements.

o The qualitative considerations apply to evaluating materiality with respect to

the financial statements and to additional factors that relate to the perceived
needs of reasonable persons who will rely on the information. AS 2.6
describes some qualitative considerations.

* AU sec. 312, Audit Risk and Materiality in Conducting an Audit, provides

additional explanation of materiality.

2
 Guiding Principles
The principles set forth below correspond to the box numbers on the appropriate charts
included in this paper.

The evaluation of individual exceptions and deficiencies is an iterative process.

Although this paper depicts the evaluation process as a linear progression, it may be
appropriate at any point in the process to return to and reconsider any previous step based
on new information.

In applying the framework, the following should be considered in determining which

chart(s) to use for evaluating individual exceptions and deficiencies:
o Chart 1 is used to evaluate and determine whether an exception noted in
performing tests of operating effectiveness represents a control deficiency.
o Chart 2 is used to evaluate and classify control deficiencies in manual or
automated controls that are directly related to achieving relevant financial
statement assertions.
o Chart 3 is used to evaluate and classify deficiencies in ITGCs that are intended to
support the continued effective operation of controls related to one or more
relevant financial statement assertions. If an application control deficiency is
related to or caused by an ITGC deficiency, the application control deficiency is
evaluated using Chart 2 and the ITGC deficiency is evaluated using Chart 3.
o Chart 4 is used to evaluate and classify control deficiencies in pervasive controls
other than ITGC. Such control deficiencies generally do not directly result in a
misstatement. However, they may contribute to the likelihood of a misstatement
at the process level.

After evaluating and classifying individual deficiencies, consideration should be given to

the aggregation of the deficiencies using the guiding principles outlined in “Consider and
Evaluate Deficiencies in the Aggregate” below.

Evaluating Exceptions
Found in the Testing of Operating Effectiveness (Chart 1)

General. The testing of controls generally relates to significant processes and major
classes of transactions for relevant financial statement assertions related to
significant accounts and disclosures. Therefore, the underlying assumption
is that all exceptions/deficiencies resulting from the testing must be
evaluated because they relate to accounts and disclosures that are material
to the financial statements taken as a whole.

The purpose of tests of controls is to achieve a high level of assurance that

the controls are operating effectively. Therefore, the sample sizes used to
test controls should provide that level of comfort. In cases in which
samples are selected using a statistically based approach, sample sizes for
frequently operating manual controls that result in less than a 90% level of

3
 confidence that the upper limit deviation rate does not exceed 10%
typically would not provide a high level of assurance. (Refer to the AICPA
Audit and Accounting Guide, Audit Sampling).

The magnitude of a control deficiency (i.e., deficiency, significant

deficiency, or material weakness) is evaluated based on the impact of
known and/or potential misstatements on annual and interim financial
statements.

While some of the concepts discussed in this paper relate to statistical

sampling, the framework does not require the use of statistical sampling. A
statistical sample is (1) selected on a random or other basis that is
representative of the population and (2) evaluated statistically. In tests of
internal controls, it may be impractical to select samples randomly, but
they should be selected in an unbiased manner.

Box 1. All exceptions should be evaluated quantitatively and qualitatively. A

thorough understanding of the cause of the exception is important in
evaluating whether a test exception represents a control deficiency. This
evaluation should consider the potential implications with regard to the
effectiveness of other controls, e.g., the company’s ITGCs and other COSO
components.

In concluding whether the test objective was met, considerations include:

o The deviation rate in relation to the frequency of performance of the
control (e.g., absent extending the test, there is a presumption that an
exception in a control that operates less frequently than daily is a
control deficiency).
o Qualitative factors, including exceptions that are determined to be
systematic and recurring or that relate to the factors outlined in AS
2.133, 139, and 140.
o Whether the exception is known to have resulted in a financial
statement misstatement (e.g., there is a presumption that an
exception that results in a financial statement misstatement in excess
of the level of precision at which the control is designed to operate,
is a control deficiency).

A control objective may be achieved by a single control or a combination

of controls. A test of controls may be designed to test a single control that
alone achieves the control objective or a number of individual controls that
together achieve the control objective.

Box 2. If the test objective is not met, consideration should be given to whether
additional testing could support a conclusion that the deviation rate is not
representative of the total population. For example, if observed exceptions
result in a non-negligible deviation rate, then the test objective initially is
not met. In a test designed to allow for finding one or more deviations, the

4
 test objective is not met if the actual number of deviations found exceeds
the number of deviations allowed for in the plan.

Box 3. If the test objective initially is not met, then there are two options:
o If the observed exceptions and resulting non-negligible deviation
rate are not believed to be representative of the population (e.g.,
because of sampling error), the test may be extended and re-
evaluated.
o If the observed exceptions and resulting non-negligible deviation
rate are believed to be representative of the population, the
exceptions are considered to be a control deficiency and its
significance is assessed.

Evaluating Process/Transaction-Level Control Deficiencies (Chart 2)

Step 1. Determine whether a significant deficiency exists:

Box 1. When evaluating deficiencies, potential magnitude (inconsequential, more

than inconsequential, or material) is based on the potential effect on both
annual and interim financial statements. The potential magnitude of a
misstatement of annual or interim financial statements of not more than
inconsequential results in the deficient control being classified as only a
deficiency, absent any qualitative factors, including those in AS 2.9, 137,
139, and 140. Potential magnitude of misstatement may be based on gross
exposure, adjusted exposure, or other appropriate methods that consider the
likelihood of misstatement.

Box 2&3. If there are controls that effectively mitigate a control deficiency, it is
classified as only a deficiency, absent any qualitative factors, including
those in AS 2.9, 137, 139, and 140. Such controls include:
o Complementary or redundant controls that achieve the same control
objective
o Compensating controls that operate at a level of precision that would
result in the prevention or detection of a more than inconsequential
misstatement of annual or interim financial statements

Boxes 1, 2, and 3 should be considered separately. Adjusted exposure

should not be reduced by the quantitative impact of the compensating and
complementary or redundant controls.

Box 3. An unmitigated deficient control that results in a control objective not

being met related to a significant account or disclosure generally results in
a more than remote likelihood of a more than inconsequential misstatement
of annual or interim financial statements and, therefore, is at least a
significant deficiency.

5
Step 2. Determine whether a material weakness exists:

Box 4. The potential magnitude of a misstatement of annual or interim financial

statements that is less than material results in the deficient control being
classified as only a significant deficiency, absent any qualitative factors,
including those in AS 2.9, 137, 139, and 140. Potential magnitude may be
based on gross exposure, adjusted exposure, or other appropriate methods
that consider the likelihood of misstatement.

Box 5. Compensating controls that operate at a level of precision that would result
in the prevention or detection of a material misstatement of annual or
interim financial statements may support a conclusion that the deficiency is
not a material weakness.

Box 6. In evaluating likelihood and magnitude, related factors include but are not
limited to the following:
o The nature of the financial statement accounts, disclosures, and
assertions involved; for example, suspense accounts and related
party transactions involve greater risk.
o The susceptibility of the related assets or liability to loss or fraud;
that is, greater susceptibility increases risk.
o The subjectivity, complexity, or extent of judgment required to
determine the amount involved; that is, greater subjectivity,
complexity, or judgment, like that related to an accounting estimate,
increases risk.
o The cause and frequency of known or detected exceptions in the
operating effectiveness of a control; for example, a control with an
observed non-negligible deviation rate is a deficiency.
o The interaction or relationship with other controls; that is, the
interdependence or redundancy of controls.
o The possible future consequences of the deficiency.
o An indication of increased risk evidenced by a history of
misstatements, including misstatements identified in the current year
(AS 2.140).
o The adjusted exposure in relation to overall materiality.

This framework recognizes that in evaluating deficiencies, the risk of

misstatement might be different for the maximum possible misstatement
than for lesser possible amounts.

As a result of this additional evaluation, determine whether the likelihood

of a material misstatement to both the annual and interim financial
statements is remote. In extremely rare circumstances, this additional
evaluation could result in a judgment that the likelihood of a more than
inconsequential misstatement to both the annual and interim financial
statements is remote.

6
 Box 7&8. When determining the classification of a deficiency, consider AS 2.137,
which states:

When evaluating the significance of a deficiency in internal control

over financial reporting, the auditor also should determine the level of
detail and degree of assurance that would satisfy prudent officials in
the conduct of their own affairs that they have reasonable assurance
that transactions are recorded as necessary to permit the preparation of
financial statements in conformity with generally accepted accounting
principles. If the auditor determines that the deficiency would prevent
prudent officials in the conduct of their own affairs from concluding
that they have reasonable assurance,* then the auditor should deem the
deficiency to be at least a significant deficiency. Having determined in
this manner that a deficiency represents a significant deficiency, the
auditor must further evaluate the deficiency to determine whether
individually, or in combination with other deficiencies, the deficiency
is a material weakness.

Note: AS 2.9 and .10 provide the definitions of significant deficiency

and material weakness, respectively.

* See SEC Staff Accounting Bulletin Topic 1M2, Immaterial

Misstatements That Are Intentional, for further discussion about the
level of detail and degree of assurance that would satisfy prudent
officials in the conduct of their own affairs.

Additional considerations related to misstatements identified:

A greater than de minimis misstatement of annual or interim financial statements

identified by management or by the auditor during a test of controls or during a
substantive test is ordinarily indicative of a deficiency in the design and/or operating
effectiveness of a control, which is evaluated as follows:
o The design and/or operating deficiency(ies) that did not prevent or detect the
misstatement should be identified and evaluated based on Chart 2 –
Evaluating Process/Transaction-Level Control Deficiencies – applying the
following:
ƒ A known or likely (including projected) misstatement that is
inconsequential to annual or interim financial statements is at least a
deficiency.
ƒ A known or likely (including projected) misstatement that is more than
inconsequential to annual or interim financial statements is a strong
indicator of a significant deficiency.
ƒ A known or likely (including projected) misstatement that is material
to annual or interim financial statements, as addressed in AS 2.140, is
at least a significant deficiency and a strong indicator of a material
weakness.
o The implications on the effectiveness of other controls, particularly
compensating controls, also should be considered.

7
 Evaluating ITGC Deficiencies (Chart 3)

General. Deficiencies in ITGCs are evaluated in relation to their effect on

application controls.
o ITGC deficiencies do not directly result in misstatements.
o Misstatements may result from ineffective application controls.

There are three situations in which an ITGC deficiency can rise to the level
of a material weakness:
o An application control deficiency related to or caused by an ITGC
deficiency is classified as a material weakness
o The pervasiveness and significance of an ITGC deficiency leads to a
conclusion that there is a material weakness in the company’s
control environment
o In accordance with AS 2.140, an ITGC deficiency classified as a
significant deficiency remains uncorrected after some reasonable
period of time

In evaluating the effect of an ITGC deficiency on the continued effective

operation of application controls, it is not necessary to contemplate the
likelihood that an effective application control could in a subsequent year
become ineffective because of the deficient ITGC.

Relationship between ITGCs and application controls. An

understanding of the relationship among applications relevant to internal
control over financial reporting, the related application controls, and ITGCs
is necessary to appropriately evaluate ITGC deficiencies. ITGCs may
affect the continued effective operation of application controls. For
example, an effective security administration function supports the
continued effective functioning of application controls that restrict access.
As another example, effective program change controls support the
continued effective operation of programmed application controls, such as
a three-way match. ITGCs also may serve as controls at the application
level. For example, ITGCs may directly achieve the control objective of
restricting access and thereby prevent initiation of unauthorized
transactions.

Similarly, ITGC deficiencies may adversely affect the continued effective

functioning of application controls; in the absence of application controls,
ITGC deficiencies also may represent control deficiencies for one or more
relevant assertions.

Evaluating ITGC deficiencies. All ITGC deficiencies are evaluated using

Chart 3. Additionally, if an ITGC deficiency also represents a deficiency
at the application level because it directly relates to an assertion, the ITGC
deficiency also is evaluated using Chart 2. In all cases, an ITGC deficiency
is considered in combination with application controls to determine
whether the combined effect of the ITGC deficiency and any application

8
 control deficiencies is a deficiency, significant deficiency, or material
weakness.

Box 1. Controls that effectively mitigate a control deficiency result in the

deficiency being classified as only a deficiency, absent any qualitative
factors, including those described in AS 2.9, 137, 139, and 140. Such
controls include complementary or redundant controls that achieve the
same control objective. An ITGC deficiency identified as a result of an
application control deficiency indicates that other ITGCs could not have
achieved the same control objective as the deficient ITGC.

Box 2. If no deficiencies are identified at the application level (as evaluated in

Chart 2), the ITGC deficiency could be classified as only a deficiency.
(Refer to Box 5.)

Box 3&4. If there is a control deficiency at the application level related to or caused
by an ITGC deficiency, the ITGC deficiency is evaluated in combination
with the deficiency in the underlying application control and generally is
classified consistent with the application control deficiency, that is:
o A material weakness in an application control related to or caused by
an ITGC deficiency indicates that the ITGC deficiency also is a
material weakness.
o A significant deficiency in an application control related to or caused
by an ITGC deficiency indicates that the ITGC deficiency also is a
significant deficiency.
o An application control deficiency (that is only a deficiency) related
to or caused by an ITGC deficiency generally indicates that the
ITGC deficiency is only a deficiency.

Box 5. Notwithstanding the guiding principles relating to Boxes 1 through 4, the

classification of an ITGC deficiency(ies) should consider factors including
but not limited to the following:
o The nature and significance of the deficiency, e.g., does the
deficiency relate to a single area in the program development process
or is the entire process deficient?
o The pervasiveness of the deficiency to applications and data,
including:
ƒ The extent to which controls related to significant accounts and
underlying business processes are affected by the ITGC
deficiency
ƒ The number of application controls that are related to the ITGC
deficiency
ƒ The number of control deficiencies at the application level that
are related to or caused by the ITGC deficiency
o The complexity of the company’s systems environment and the
likelihood that the deficiency could adversely affect application
controls
o The relative proximity of the control to applications and data

9
 o Whether an ITGC deficiency relates to applications or data for
accounts or disclosures that are susceptible to loss or fraud
o The cause and frequency of known or detected exceptions in the
operating effectiveness of an ITGC; for example, (1) a control with
an observed non-negligible deviation rate, (2) an observed exception
that is inconsistent with the expected effective operation of the
ITGC, or (3) a deliberate failure to apply a control .
o An indication of increased risk evidenced by a history of
misstatements relating to applications affected by the ITGC
deficiency, including misstatements in the current year

When determining the classification of a deficiency, consider AS 2.137,

which states:

When evaluating the significance of a deficiency in internal control

over financial reporting, the auditor also should determine the level of
detail and degree of assurance that would satisfy prudent officials in
the conduct of their own affairs that they have reasonable assurance
that transactions are recorded as necessary to permit the preparation of
financial statements in conformity with generally accepted accounting
principles. If the auditor determines that the deficiency would prevent
prudent officials in the conduct of their own affairs from concluding
that they have reasonable assurance,* then the auditor should deem the
deficiency to be at least a significant deficiency. Having determined in
this manner that a deficiency represents a significant deficiency, the
auditor must further evaluate the deficiency to determine whether
individually, or in combination with other deficiencies, the deficiency
is a material weakness.

Note: AS 2.9 and .10 provide the definitions of significant deficiency

and material weakness, respectively.

* See SEC Staff Accounting Bulletin Topic 1M2, Immaterial

Misstatements That Are Intentional, for further discussion about the
level of detail and degree of assurance that would satisfy prudent
officials in the conduct of their own affairs.

Additional consideration:

ITGCs support the proper and consistent operation of automated application controls.
Therefore, consideration should be given to the nature, timing, and extent of the
testing of related application controls affected by, or manual controls dependent on,
the deficient ITGC.

10
 Evaluating Control Deficiencies in Pervasive Controls Other than ITGC (Chart 4)

General. Deficiencies in pervasive controls generally do not directly result in a

misstatement. However, they may contribute to the likelihood of a
misstatement at the process level. Accordingly, evaluation of a deficiency
in a pervasive control other than ITGC is based on the likelihood that such
deficiency would contribute to circumstances that could result in a
misstatement. Quantitative methods generally are not conducive to
evaluating such deficiencies.

Step 1. Determine whether a significant deficiency exists:

Box 1&2. A deficiency of the type described in AS 2.139 ordinarily results in

deficiencies being at least a significant deficiency. The circumstances in
which an evaluation would lead to the deficiency not being classified as a
significant deficiency are rare. The circumstances identified in AS.140
should be regarded as at least a significant deficiency and as a strong
indicator of a material weakness.

Box 3. Certain controls could result in a judgment that the deficient control is
limited to a deficiency and classified as only a deficiency, considering
qualitative factors, including those in AS 2.9, 137, 139 and 140. Such
controls include:
o Complementary or redundant programs or controls
o Compensating controls within the same or another component

Box 4. A deficiency with a more than remote likelihood that the deficiency would
contribute to a more than inconsequential misstatement is a significant
deficiency. Such judgment considers an evaluation of factors such as:
o The pervasiveness of the deficiency across the entity
o The relative significance of the deficient control to the component
o An indication of increased risks of error (evidenced by a history of
misstatement)
o An increased susceptibility to fraud (including the risk of
management override)
o The cause and frequency of known or detected exceptions for the
operating effectiveness of a control
o The possible future consequences of the deficiency

Step 2. Determine whether a material weakness exists:

Box 5. The evaluation of certain controls could result in a judgment that the
deficient control is limited to a significant deficiency and classified as
such, considering qualitative factors, including those in AS 2.9, 137, 139
and 140. Such controls include compensating controls within the same or
another component.

11
Box 6. A deficiency with a more than remote likelihood that the deficiency would
contribute to a material misstatement is a material weakness. Such
judgment considers an evaluation of factors such as:
o The pervasiveness of the deficiency across the entity
o The relative significance of the deficient control to the component
o An indication of increased risks of error (evidenced by a history of
misstatement)
o An increased susceptibility to fraud (including the risk of management
override)
o The cause and frequency of known or detected exceptions for the
operating effectiveness of a control
o The possible future consequences of the deficiency

A deficiency of the type described in AS 2.140 is generally a material

weakness; in limited circumstances, it may be appropriate to conclude the
deficiency is only a significant deficiency (refer to AS.2 Appendix E99).

Box 7&8. When determining the classification of a deficiency, consider AS 2.137,

which states:

When evaluating the significance of a deficiency in internal control

over financial reporting, the auditor also should determine the level
of detail and degree of assurance that would satisfy prudent
officials in the conduct of their own affairs that they have
reasonable assurance that transactions are recorded as necessary to
permit the preparation of financial statements in conformity with
generally accepted accounting principles. If the auditor determines
that the deficiency would prevent prudent officials in the conduct
of their own affairs from concluding that they have reasonable
assurance,* then the auditor should deem the deficiency to be at
least a significant deficiency. Having determined in this manner
that a deficiency represents a significant deficiency, the auditor
must further evaluate the deficiency to determine whether
individually, or in combination with other deficiencies, the
deficiency is a material weakness.

Note: AS2.9 and .10 provide the definitions of significant

deficiency and material weakness, respectively.

* See SEC Staff Accounting Bulletin Topic 1M2, Immaterial

Misstatements That Are Intentional, for further discussion about
the level of detail and degree of assurance that would satisfy
prudent officials in the conduct of their own affairs.

12
 Consider and Evaluate Deficiencies in the Aggregate

Deficiencies are considered in the aggregate by significant account balance, disclosure

and COSO component to determine whether they collectively result in significant
deficiencies or material weaknesses. Aggregation of control activities deficiencies by
significant account balance and disclosure is necessary since the existence of multiple
control deficiencies related to a specific account balance or disclosure increases the
likelihood of misstatement. Aggregation by the control environment, risk assessment,
information and communication, and monitoring components of COSO is more difficult
and judgmental. For example, unrelated control deficiencies relating to design
ineffectiveness in other COSO components could lead to the conclusion that a significant
deficiency or material weakness in the risk assessment component exists. Similarly,
unrelated control deficiencies in other COSO components could lead to a conclusion that
a significant deficiency or material weakness in the control environment or monitoring
component exists.

13
 Terminology
Adjusted exposure – gross exposure (see below) multiplied by the upper limit deviation
rate.

Application controls – automated control procedures (e.g., calculations, posting to

accounts, generation of reports, edits, control routines, etc.) or manual controls that are
dependent on IT (e.g., the review by an inventory manager of an exception report when
the exception report is generated by IT). When IT is used to initiate, authorize, record,
process, or report transactions or other financial data for inclusion in financial statements,
the systems and programs may include controls related to the corresponding assertions
for significant accounts or disclosures or may be critical to the effective functioning of
manual controls that depend on IT.

Compensating controls – controls that operate at a level of precision that would result in
the prevention or detection of a misstatement that was more than inconsequential or
material, as applicable, to annual or interim financial statements. The level of precision
should be established considering the possibility of further undetected misstatements.

Complementary controls – controls that function together to achieve the same control
objective.

Control deficiency – a deficiency in the design or operation of a control that does not
allow management or employees, in the normal course of performing their assigned
functions, to prevent or detect misstatements on a timely basis.
o A deficiency in design exists when (a) a control necessary to meet the control
objective is missing or (b) an existing control is not properly designed so that, even if
it operates as designed, the control objective is not always met.
o A deficiency in operation exists when a properly designed control does not operate
as designed, or when the person performing the control does not possess the
necessary authority or qualifications to perform the control effectively.

Control objective – the objective(s) related to internal control over financial reporting to
achieve the assertions that underlie a company’s financial statements.

Gross exposure – a worst-case estimate of the magnitude of amounts or transactions

exposed to the deficiency with regard to annual or interim financial statements, without
regard to the upper limit deviation rate or likelihood of misstatement, and before
considering complementary, redundant, or compensating controls. Factors affecting
gross exposure include:
o The annual or interim financial statement amounts or total transactions exposed to
the deficiency.
o The volume of activity in the account balance or class of transactions exposed to the
deficiency that has occurred in the current annual or interim period or that is
expected in future periods.

14
Inconsequential
o Potential misstatements equal to or greater than 20% of overall annual or interim
financial statement materiality are presumed to be more than inconsequential.
o Potential misstatements less than 20% of overall annual or interim financial
statement materiality may be concluded to be more than inconsequential as a result
of the consideration of qualitative factors, as required by AS 2.

Information technology general controls (ITGCs) – policies and procedures that relate to
many applications and support the effective functioning of application controls by helping
to ensure the continued proper operation of information systems. This includes four basic
IT areas that are relevant to internal control over financial reporting:
o Program development
o Program changes
o Computer operations
o Access to programs and data

Material weakness – a significant deficiency, or combination of significant deficiencies,

that results in more than a remote likelihood that a material misstatement of the annual or
interim financial statements will not be prevented or detected.

Pervasive controls other than ITGC – the general programs and controls within the
control environment, risk assessment, monitoring, and information and communication,
including portions of the financial reporting process, that have a pervasive impact on
controls at the process, transaction, or application level.

Potential misstatement – an estimate of the misstatement that could result from a

deficiency with a more than remote likelihood of occurrence.

Redundant controls – controls that achieve the same control objective.

Remote likelihood – the chance of the future event or events occurring is slight.

Significant deficiency – a control deficiency, or combination of control deficiencies, that

adversely affects the company's ability to initiate, authorize, record, process, or report
external financial data reliably in accordance with generally accepted accounting principles
such that there is more than a remote likelihood that a misstatement of the company's
annual or interim financial statements that is more than inconsequential will not be
prevented or detected.

Test objective – the design of the test of a control activity to determine whether the
control is operating as designed, giving consideration to:
o The nature of the control and the definition of an exception
o The frequency with which the control operates
o The desired level of assurance in combination with the reliability of the control, for
example, whether the control is designed to achieve the control objective alone or in
combination with other controls
o The number of exceptions expected

15
Upper limit deviation rate – the statistically derived estimate of the deviation rate based
on the sample results, for which there is a remote likelihood that the true deviation rate in
the population exceeds this rate (refer to AICPA Audit and Accounting Guide, Audit
Sampling).

16
CHART 1 – Evaluating Exceptions Found in the Testing of
Operating Effectiveness

Box 1. Examine and understand cause and results of

exceptions. Was the test objective met (e.g., was the
actual deviation rate less than or equal to the planned
deviation rate)?

No

Box 2. Considering the results of management’s and

the auditor’s testing and the information obtained in Yes
Box 1, could additional testing support a conclusion
that the deviation rate or observed exception is not
representative of the total population?
No

Yes

No Box 3. Extend testing and re-evaluate. Was the test Yes Negligible exception,
Control deficiency objective met? not a control
deficiency. No further
consideration needed.

Individual boxes should be read in conjunction with the corresponding guiding principles.

17
CHART 2 – Evaluating Process/Transaction-Level Control
Deficiencies
This decision tree is to be used for evaluating the classification of control deficiencies from the
following sources:
• Design effectiveness evaluation
• Operating effectiveness testing (from Chart 1)
• Deficiencies that resulted in a financial statement misstatement detected by management or
the auditor in performing substantive test work.

Step 1: Determine whether a significant deficiency exists.

Box 1. Is the potential magnitude

inconsequential to both annual and
Yes
interim financial statements?

No
Box 7. Would a prudent
Box 2. Are there complementary or official conclude that
Yes No
redundant controls that were tested and the deficiency is at least
a significant deficiency Deficiency
evaluated that achieve the same
control objective? considering both annual
No and interim financial
No statements?

Box 3. Are there compensating

controls that were tested and evaluated Yes
Yes
that reduce the magnitude of a
misstatement of both annual and
interim financial statements to
inconsequential?

No Step 2: Determine whether a material weakness exists.

Box 4. Is the potential magnitude less

than material to both annual and
interimNofinancial statements? Yes

No

Box 5. Are there compensating Box 8. Would a prudent

controls that were tested and evaluated official conclude that
Yes No Significant
that reduce the magnitude of a the deficiency is a
misstatement of both annual and material weakness Deficiency
interim financial statements to less considering both annual
than material? and interim financial
statements?
No

Box 6. Does additional evaluation Yes

result in a judgment that the likelihood Yes
of a material misstatement of both
annual
No and interim financial statements
is remote?

No

Material
Weakness

Individual boxes should be read in conjunction with the corresponding guiding principles.

18
CHART 3 – Evaluating Information Technology General
Control (ITGC) Deficiencies
This decision tree is to be used for evaluating the classification of information technology general
control (ITGC) deficiencies from the following sources:
• ITGC design effectiveness evaluation
• ITGC operating effectiveness testing (from Chart 1)
• ITGC design or operating deficiencies identified as a result of application control testing
(from Chart 2)

Box 1. Are there complementary or

redundant ITGCs that were tested Yes
and evaluated that achieve the same
Box 5. Does
control objective?
additional
No
evaluation result
in a judgment that
the ITGC
Box 2. Are there control
No deficiency is a
deficiencies at the application level No
significant
evaluated in Chart 2 that are related
deficiency? Deficiency
to or caused by the ITGC
deficiency? OR
Would a prudent
Yes official conclude
that the ITGC
Box 3. Are the control deficiencies deficiency is a
at the application level related to or significant
caused by the ITGC deficiency deficiency?
Yes
classified as only a deficiency?
No Yes
No

Box 4. Are the control deficiencies

Yes Significant
at the application level related to or
caused by the ITGC deficiency Deficiency
classified as a significant
deficiency?

No

Material
Weakness

Individual boxes should be read in conjunction with the corresponding guiding principles.

19
CHART 4 – Evaluating Control Deficiencies in Pervasive
Controls Other than ITGC
This decision tree is to be used for evaluating the classification of control deficiencies in
pervasive controls other than ITGC from the following sources:
• Design effectiveness evaluation
• Operating effectiveness testing (from Chart 1)

Step 1: Determine whether a significant deficiency exists.

Yes Box 1. Is the deficiency in an area identified in AS

2.139 (i.e., at least a significant deficiency)?

No

Yes Box 2. Is the deficiency the result of a specific

circumstance identified in AS 2.140 (i.e., a strong
indicator of a material weakness)?

No
Box 3. Are there complementary or redundant
programs or controls or compensating controls that
were tested and evaluated that result in a judgment that Yes Box 7. Would a
the deficient control is limited to a deficiency? prudent official
conclude that the No

No deficiency is at least a Deficiency

significant deficiency
Box 4. Does additional evaluation result in a judgment considering both
that the likelihood that the control deficiency would annual and interim
contribute to a more than inconsequential misstatement financial statements?
Yes
of the annual or interim financial statements is remote?

Yes
No

Step 2: Determine whether a material weakness exists.

Box 5. Are there compensating controls that were

No that result in a judgment that the
tested and evaluated Yes Box 8. Would a
deficient control is limited to a significant deficiency? prudent official
conclude that the No Significant
deficiency is a Deficiency
No material weakness
considering both
Box 6. Does additional evaluation result in a judgment annual and interim
that the likelihood that the control deficiency would financial statements?
contribute to a material misstatement of the annual or Yes
interim financial statements is remote? Yes

No

Material
Weakness

Individual boxes should be read in conjunction with the corresponding guiding principles.

20