Material Weakness – What Are the Real Impacts?

A material weakness sounds bad, but what does it mean and how does it impact a company and who needs to know about it? A material weakness is defined as a deficiency, or combination of deficiencies, in internal control over financial reporting (“ICFR”), such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.^[1] A material weakness needs to be disclosed in a company’s financial statement, as opposed to a significant deficiency, which only has to be communicated to those charged with governance.

A key takeaway is “possibility.” This means auditors can find one or more deficiencies in the control environment and assert the environment would fail to prevent or detect a material misstatement. The impact of a material weakness is not limited to the actual error noted or company stock price upon being disclosed in the financial statements. In fact, a material weakness is not always directly linked to an identified error or restatement – it can sometimes be that “what if” factor.

What are some of the causes?

Several causes of deficiencies may aggregate to a material weakness, including:

• Inadequate segregation of duties arising from insufficient accounting personnel.
• Failure of the organization to sufficiently evaluate risk on an ongoing basis.
• Improper oversight over the work performed by third-party service providers.
• Ineffectively designed information technology (“IT”) policies and procedures or an over-reliance on IT tools.
• Improper review and approval over information utilized in the performance of a control.

These are issues that may cause or contribute to a deficiency, whether that amounts to an ineffective design or operating deficiency. Design deficiencies may arise from a multitude of factors, from the preparer not verifying the completeness and accuracy of information produced by the entity to ineffective and inadequate segregation of duties. Operating deficiency, commonly referred to as a testing of effectiveness (“TOE”) deficiency, arises after a control is deemed appropriately designed but not properly or timely performed. While these two issues may seem small, they can easily lead to a material weakness if they are centered in an area with enough risk or aggregated with other deficiencies. It is important to understand the impact a material weakness can have on a company, its culture and its business.

Effects of a Material Weakness

A significant result of a material weakness is the initial disclosure of the error and what it does to the company’s stock price, but this is not the only effect. Others include:

• Executive leadership’s tone at the top and concerns over the adequacy of their people.
• Management may feel micromanaged by executive leadership, which can cause frustration and possible turnover.
• Loss of investor confidence can decline stock prices.
• Loss of customer confidence may influence future sales and opportunities.
• Reputational damage within the industry.
• Increased scrutiny over processes, procedures and controls.
• Time, energy and effort necessary to remedy the deficiency or deficiencies may shift management’s focus too much to the remediation, rather than day-to-day responsibilities, which can result in additional issues or deficiencies in other neglected areas.

How does your organization avoid deficiencies?

• Confirm that the risks that pose a threat to the company are understood and that established controls align well to them. A risk-based approach is paramount.
• Understand how the balance sheet and income statement relate to the individual business processes and how the applicable assertions map to them.
• Make sure that technology is adequately governed and policies, procedures and controls over IT are well designed.

Lastly, accelerate your program and start evaluating early. This will identify design deficiencies as soon as possible and allow sufficient time for remediation. Put adequate resources in place to be certain controls are effectively designed, implemented and operating as intended. Constant communication is essential. Management, auditors, service providers, executives and the board should have open lines of communication to confirm risks are mitigated. If deficiencies arise, protocols can be more easily and timely implemented by getting the right people involved who have expertise in this area – so there are no surprises.

[1] https://pcaobus.org/oversight/standards/archived-standards/pre-reorganized-auditing-standards-interpretations/details/Auditing_Standard_5_Appendix_A#:~:text=2%2F,detected%20on%20a%20timely%20basis