Is it a material weakness?
Work a control deficiency through the severity framework in AS 2201 — including the four arguments that most often rate one down when they should not.
First: the four indicators
AS 2201.69 lists these as indicators of a material weakness. They are asked before anything else so they get answered before it is obvious which way they push.
Then: likelihood and magnitude
Then: the things that get used to rate it down
Each of these is a real consideration in the standard and each is routinely over-claimed. They are asked separately so the claim and the evidence for it stay apart.
The note to AS 2201.65 requires these to be assessed together. Classifying them one at a time is how a material weakness disappears into a list of small findings.
Last: the two backstops
The classification is management's to make and to support. This shows what the framework points to on the answers you give, and what would have to be true to land somewhere else.
The classification is made by the person who has to disclose it
Nothing about the definition of a material weakness is hard. A deficiency, or a combination of them, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. Anyone doing this work can recite it. The difficulty is structural rather than technical: the person deciding whether a deficiency meets that definition is usually the person who will have to publish the answer in Item 9A, explain it to the audit committee, and live with what it does to the stock.
So the pressure on the judgment runs one direction, and it is worth knowing the four arguments it tends to run through. The first is that no misstatement actually occurred — which AS 2201.64 forecloses in terms, because severity is about whether the control would fail, not whether it was tested this year. The second is a compensating control, which mitigates only if it operates at a level of precision that would catch a misstatement sized at materiality; most controls offered in this role have never been assessed against that standard. The third is that each deficiency is individually small, which the note to AS 2201.65 answers by requiring deficiencies on the same account to be evaluated together. The fourth is simply rating past one of the four indicators in AS 2201.69 — fraud by senior management, a restatement, an auditor-found material misstatement your controls missed, ineffective audit committee oversight.
None of those four is a bad-faith argument. Each is a real consideration that the standard itself contemplates. What makes them dangerous is that they are almost always available, they can each be answered in a sentence, and answering all four favourably takes a material weakness to a significant deficiency without anyone having written down a single piece of evidence.
Which is what the prudent official test is for, and why it sits at the end rather than the beginning. After every individual question has been answered defensibly, it asks whether a prudent official, looking at the whole thing in the conduct of their own affairs, would say there is reasonable assurance. It is the one question in the framework that cannot be walked, and it is the one most worth asking out loud in a room with the audit committee in it.
What this tool does not do
Every answer is yours. The tool cannot see the control, the account, or the evidence - it applies the AS 2201 severity framework to what you type, so a comfortable answer produces a comfortable classification. That is the failure mode it is built against rather than one it can prevent. Where an answer that decides the outcome is left unsure, the classification is held at the MORE severe reading and the open question is listed; that is a deliberate default, not a computation. The definitions are quoted from 17 CFR 210.1-02(a)(4) and the severity framework from PCAOB AS 2201, both fetched from the issuing source.
- Decide whether a control deficiency exists in the first place - this starts from one you have already identified
- Assess your compensating control's precision, which is the question the whole compensating-control argument turns on and requires looking at the control
- Aggregate your deficiencies for you - it asks how many share an account and tells you to re-run them combined, it cannot combine them itself
- Set or test materiality, entity-level or otherwise
- Draft the Item 9A disclosure, the material weakness description, or the remediation plan
- Tell you whether ICFR is effective overall - that is a conclusion about every deficiency together, not about this one
- Your auditor's conclusion, which applies the same framework to the same facts and is the one that gets reported on
Frequently asked questions
We found the error and fixed it before filing. Doesn't that mean it isn't a material weakness?
No. AS 2201.64 is explicit that severity "does not depend on whether a misstatement actually has occurred but rather on whether there is a reasonable possibility that the company's controls will fail to prevent or detect a misstatement." The question is whether your ICFR would have caught it. If the auditor found it and your controls would not have, that is itself one of the four indicators in AS 2201.69 — the fact that it got corrected before issuance is not the point.
We have a compensating control. Does that settle it?
Only if it operates at a level of precision that would prevent or detect a material misstatement — that is the test in AS 2201.68, and it is where most compensating-control arguments fail. A monthly management review, a budget-to-actual comparison, or a second pair of eyes will often catch an order-of-magnitude error while having no chance against a misstatement sized at materiality. If nobody can say what size of error the control would actually catch, it has not been shown to compensate for anything.
Each deficiency is small on its own. Can we assess them individually?
Not where they touch the same thing. The note to AS 2201.65 requires that deficiencies affecting the same account balance, disclosure, assertion or component of internal control be evaluated collectively, and says they may constitute a material weakness in combination "even though such deficiencies may individually be less severe." Assessing them one at a time is the most common way a material weakness ends up recorded as a list of minor findings.
What is the prudent official test actually for?
It is the backstop for the case where every individual answer looks defensible and the overall picture still does not hold together. AS 2201.70 says that if a deficiency would prevent prudent officials, in the conduct of their own affairs, from concluding they have reasonable assurance that transactions are recorded as necessary, it should be treated as an indicator of a material weakness. It exists precisely because a question-by-question exercise can be walked to a comfortable answer.
Do management and the auditor use the same definitions?
The definitions, yes — word for word. Management's Item 9A assessment runs on 17 CFR 210.1-02(a)(4) and the auditor's ICFR opinion runs on PCAOB AS 2201, and both define material weakness and significant deficiency identically. What exists only in AS 2201 is the severity framework: the likelihood and magnitude factors, the four indicators, the compensating-control precision test and the prudent official test. Management borrowing that framework is normal and sensible, and it has the advantage of being the standard that will be applied to the same facts a few weeks later.