When management's assessment reveals that control deficiencies exist as of year-end, the severity of those control deficiencies must be evaluated. If management concludes that one or more of the deficiencies are material weaknesses, then it must report that the company's internal control is not effective. Internal control is effective only if there are no material weaknesses as of year-end.

As stated in Chapter 1, a material weakness is a control deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected in a timely basis.

8.2.1. Assessing the Likelihood and Significance of Misstatement

For the purposes of evaluating the severity of control deficiencies, the key phrases in this definition are

  • "Reasonable possibility," which means that you have to assess the likelihood that a financial misstatement will result from a control failure, and

  • "Material," which means that you should assess the significance of the misstatement that would result from the control failure.

It's important to note that under this definition, the severity of a deficiency does not depend on whether a financial statement misstatement actually occurred. Rather, it depends on the likelihood that an event could happen, namely, whether there is a reasonable possibility that the company's control will fail to prevent or detect and correct a material ...

Get How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.