How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

8.1. CONTROL DEFICIENCIES

The presence of control deficiencies may change management's report on internal control effectiveness. As stated in Chapter 1:

A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

Figure 8.1. Internal Control Deficiencies

Deficiencies in internal control can arise in two ways.

1. Design Deficiency. A design deficiency exists when either:

   • A control that is necessary to achieve a control objective does not exist, or

   • An existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met.

2. Operating Deficiency. An operating deficiency exists when a properly designed control either:

   • Is not operating as designed, or

   • The person performing the procedure does not possess the necessary authority or qualifications to perform the control effectively.

As indicated in Exhibit 8.1, internal control deficiencies range from inconsequential to material weakness. Note that the three levels of deficiency are placed in a continuum. If a deficiency is not inconsequential, then it is, at a minimum, significant.

At issue is where one should draw the line, that is, at what point is a deficiency no longer inconsequential, and when does a significant deficiency ...