Control Deficiency Finding

Detects control deficiency findings from internal audits and compliance assessments.

Type

regex

Confidence

medium

Confidence justification

Medium confidence: keyword-based detection requires corroborative evidence for accurate identification.

Jurisdictions

global

Regulations

AML/CTF Act (Cth), IPA 2009 (Qld), Privacy Act 1988 (Cth)

Frameworks

ISO 27001, NIST CSF, PCI-DSS

Data categories

security, audit

Scope

narrow

Risk rating

8

Should match

• Control deficiency — Low-tier probe - deficiency phrase without control-testing detail
• Control deficiency: test of controls found an access-control and segregation-of-duties failure. — Medium-tier probe - control-testing evidence without remediation tracking
• Significant deficiency: control testing found an ITGC access-control failure; corrective action owner and target date assigned. — High-tier probe - tested control failure plus remediation tracking

Should not match

• Quality control procedures — Quality-control sibling
• Remote control battery replacement — Consumer-device sibling
• The public accounting guide defines a significant deficiency. — Public guidance contains only the deficiency phrase
• Template example: significant deficiency from control testing with an ITGC failure, corrective action owner, and target date. — Template contains otherwise high-tier evidence

Known false positives

• Generic control in non-audit contexts. Mitigation: Require audit-specific terms like deficiency, material weakness, or finding severity.