Why Control deficiency matters to internal audit and controllers
A design deficiency means the control would miss the problem even if it ran as intended. An operating deficiency means a well-designed control was not performed as designed.
Under SOX and PCAOB AS 2201, deficiencies are graded. A significant deficiency merits the audit committee's attention. A material weakness is a reasonable possibility that a material misstatement will not be prevented or detected on time, and it must be disclosed.
An exception is not automatically a deficiency. The team weighs its cause and frequency first.
Grading matters. Too harsh, and the audit committee loses trust. Too soft, and the external auditor may disagree.
An example
A control says the controller reviews every manual journal above a set amount. Testing finds that journals posted by the controller are also approved by the controller. The review exists but cannot work for those journals. That is a design deficiency.
How IRAME handles it
IRA, IRAME's AI auditor, classifies each exception as a true exception, business as usual or a false positive. True exceptions are marked as a design deficiency or procedural non-compliance; your team decides the severity. Reports set out each as Finding, Impact, Risk and Recommendation.