## SA 265 – Deficiency in Internal Control
### What is a Deficiency in Internal Control?
A deficiency in internal control exists when:
| Type | Description |
|---|---|
| Control Design Deficiency | A control is designed or implemented in a way that it is unable to prevent, detect, or correct misstatements on a timely basis |
| Missing Control | A control necessary to prevent, detect, or correct misstatements is absent |
> Think of it this way: either the control exists but doesn't work, or it simply doesn't exist at all.
---
### Significant Deficiency
Definition: A deficiency (or combination of deficiencies) in internal control that, in the auditor's professional judgement, is of sufficient importance to merit the attention of Those Charged with Governance (TCWG).
- Not every deficiency is a significant deficiency — significance depends on auditor's professional judgement.
- Significance depends on both: (i) likelihood that misstatement will occur, and (ii) magnitude/potential size of the misstatement.
---
### Factors Auditor Considers in Deciding if a Deficiency is Significant
| # | Factor |
|---|---|
| a | Likelihood that the deficiency leads to a material misstatement |
| b | FS amount exposed to the deficiency |
| c | Susceptibility of related assets to loss or fraud; related assertions |
| d | Volume of activity in the assertion exposed to the deficiency |
| e | Cause and frequency of exceptions detected due to the deficiency |
| f | Interaction of the deficiency with other deficiencies |
| g | Subjectivity and complexity in determining accounting estimates |
| h | Importance of the control relating to financial reporting process |
For (h) — Controls of particular importance include:
- Period-end financial reporting process
- Fraud-related controls
- Significant accounting policies
- General monitoring controls