Control Deficiency Finding

Detects populated internal-control deficiency findings (control deficiency, significant deficiency, material weakness, ICFR weakness) that carry a finding reference, rating, accountable owner or remediation due date. Definitions and accounting guidance stay discovery-only.

Type

regex

Confidence

medium

Confidence justification

Enforce tiers require populated finding fields beside the deficiency phrase; accounting guides, standards text and news about a company's material weakness carry no such fields and stay at 65. Medium because audit methodology documents with worked examples can still match.

Jurisdictions

global

Regulations

Corporations Act 2001 (Cth), SOX, Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)

Frameworks

ISO 27001, NIST CSF, PCI-DSS

Data categories

security, audit

Scope

narrow

Risk rating

8

Corroborative evidence keywords

test of controls, control testing, key control, detective control, preventive control, IT general controls, ITGC, segregation of duties, user access review, operating effectiveness

Proximity: 300 characters

Should match

• INTERNAL AUDIT - CONTROL DEFICIENCY Finding ID: IA-2026-014 Rating: Significant deficiency Control owner: Jordan Staffson, Financial Controller Target date: 30/11/2026 Test of controls over the user access review found 7 of 25 privileged accounts not reviewed; segregation of duties conflict in the payments module. — Populated finding - ID, rating, owner, date and testing evidence (85)
• Control deficiency - accounts payable Action owner: Casey Rourke Vendor master changes were approved by the same officer who entered them. — Finding with a single populated owner field (75)
• ICFR deficiency evaluation - FY2026 year-end Issue ID: ICFR-26-007 Deficiency type: Material weakness Items tested: 40 Exceptions noted: 9 Remediation date: 15/03/2027 IT general controls over change management failed operating effectiveness testing for the general ledger system. — ICFR evaluation with issue ID, deficiency type, testing counts, remediation date and ITGC evidence (85)

Should not match

• Policy guidance: a control deficiency exists when the design or operation of a control does not allow staff to prevent or detect misstatements. Rate each finding and record an owner and a target date. — Methodology guidance without populated fields
• CONTROL DEFICIENCY Finding ID: __________ Rating: __________ Control owner: __________ Target date: __________ — Blank finding form - placeholder values
• Auditors reported a material weakness in internal control over financial reporting at the retailer, sending its shares down 8% on Tuesday. — News about a public disclosure
• Quality control procedures — Unrelated control wording
• Remote control battery replacement — Unrelated control wording
• The public accounting guide defines a significant deficiency. — Accounting guide definition
• Template example: significant deficiency from control testing with an ITGC failure, corrective action owner, and target date. — Template framing

Known false positives

• Auditing standards, accounting guides and training defining control deficiencies. Mitigation: No populated finding fields, and guidance framing is excluded.
• Public company disclosures of a material weakness in annual reports. Mitigation: Public disclosures rarely carry finding IDs, owners and due dates; if they do they reach 75 and should be treated as published.

References

• PCAOB AS 2201 - An Audit of Internal Control Over Financial Reporting
• APRA CPS 220 Risk Management