Material weakness vs significant deficiency on a Call Report control

The difference between a material weakness and a significant deficiency is severity. The SEC defines a material weakness as "a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis." A significant deficiency is one "that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant's financial reporting." A control deficiency is anything below that. For a bank the question reaches the Call Report, because Part 363 counts regulatory reports as financial reporting, and the hard part is consistency: the same self-reviewed reconciliation should get the same grade in March and in October. Botminds' Regulatory Reporting Controls proposes a grade with its reasoning and leaves the decision with the Controller.

What is a control deficiency?

A control deficiency is the base grade: a control that, as designed or as operated, does not do its job. GAO's standards, which adapt the COSO framework, put it this way: "A deficiency in internal control exists when the design, implementation, or operation of a control does not allow management or other personnel, in the normal course of performing their assigned responsibilities, to achieve the entity's objectives" (GAO Green Book, para. OV3.07). Design deficiencies are missing or badly built controls; operating deficiencies are good controls that did not run as designed on some instance.

Most findings stop here. A preparer who reviewed her own reconciliation once, a journal entry approved the morning after it was posted, a vendor change approved by its requester: each is a control deficiency until someone asks how likely it was to let a material error through and how large that error could have been. Asked honestly, most stay where they are. A few do not.

Material weakness vs significant deficiency: how severity is judged

Severity turns on two questions and one modifier. How likely is it that the deficiency would fail to prevent or detect a misstatement? How large could that misstatement be? And is there another control that would have caught it? GAO's standards list the same factors as "Magnitude of impact", "Likelihood of occurrence" and "Nature of the deficiency", and add: "Deficiencies are evaluated both on an individual basis and in the aggregate." (GAO Green Book, paras. OV3.08–OV3.09).

The test is a possibility, not an event. A material weakness does not require that a material misstatement happened; it requires a reasonable possibility that one would not be caught. That is why a self-review on a reconciliation of a $2.5 billion loan balance is not cleared just because the balance turned out to tie. The question is what would have happened if it had not tied, and whether anything else stood in the way.

The table is useful less for its answers than for its shape. Each row states likelihood, magnitude and the compensating control before the grade, so the reasoning can be challenged. Change the third column of the first row to "difference of $40 million, unexplained", or the fourth to "variance review not performed", and the grade should change with it. A severity guide that does not make that visible is a list of opinions.

What is a significant deficiency, and when does a control deficiency become one?

A significant deficiency is defined by its audience: it is "important enough to merit attention by those responsible for oversight" of financial reporting (17 CFR 240.12b-2), which in a bank means the audit committee. The practical test is whether a committee member, told of it, would want to know what management is doing about it. A one-off timing exception on a well-compensated control fails that test. The same exception recurring every month on the control over a capital line passes it.

Four patterns are reasons to look again at a control deficiency's grade: the control guards a line that feeds regulatory capital or a ratio near a threshold; no other control would have caught the error; the same failure recurs across instances or quarters; or several deficiencies touch the same line or the same people. The last is the one most often missed, because each finding is graded on its own day by a different reviewer. A single list of open deficiencies, read by line and by owner, is what makes the aggregate visible.

Can a Call Report error be a material weakness?

Yes, for an institution in scope of Part 363's internal control assessment. Part 363 says that, for its management report and internal control requirements, financial reporting includes at a minimum both the GAAP statements and the statements prepared for regulatory reporting (12 CFR 363.1(c)). At $5 billion and above, management "must disclose all material weaknesses in internal control over financial reporting, if any, that it has identified that have not been remediated prior to the insured depository institution's fiscal year-end" and "is precluded from concluding that the insured depository institution's internal control over financial reporting is effective if there are one or more material weaknesses" (12 CFR 363.2(b)(3)(iii)).

Republic First Bank shows how far the consequences run. The FDIC's Inspector General reported that the bank's auditors "ultimately identified three material weaknesses for Republic Bank, two of which were specific to Board oversight of related-party transactions and failure to provide effective oversight of branch expenditures", that weaknesses in account reconciliations kept delaying its reporting through 2023, and that the 2023 examination found internal controls over reconcilements and financial reporting unsatisfactory, with inaccurate Call Reports among the results (FDIC OIG, Material Loss Review of Republic First Bank, 2024). The bank failed in April 2024.

A material weakness does not need a material error. It needs a reasonable possibility that one would get through.

Who decides whether a deficiency is a material weakness?

Management decides, the audit committee oversees, and the auditor reaches its own view. The rules put the conclusion on named people: the CEO and CFO sign the Part 363 management report, and section 302 officers certify that they have disclosed "all significant deficiencies in the design or operation of internal controls" and identified any material weaknesses to the auditors and the audit committee (15 U.S.C. 7241(a)(5)). GAO's standards add: "The oversight body oversees management's evaluation of the significance of deficiencies so that deficiencies have been properly considered."

Below them, someone has to make the first call every time a control fails, and that is where consistency is won or lost. In the sample bank the Controller decides every grade, an agent proposes it first with its reasoning written out against the bank's severity guide, and anything proposed above a control deficiency goes to the audit committee. The external accountant still evaluates deficiencies independently: Part 363 asks institutions to file any written communication of significant deficiencies and material weaknesses the accountant issues within 15 days of receiving it (12 CFR 363.4(c)).

The grade proposed with its reasoning, decided by the Controller

What is issue management in banking, for control deficiencies?

Issue management is the discipline of carrying every finding from the moment it is raised to the moment it is closed and validated, with an owner, a grade, a plan and evidence at each step. For regulatory reporting controls it is where a finding becomes either a fixed control or a repeat finding. The OCC asks examiners to assess whether audit work includes "audit validation activities and a review of management actions to address material weaknesses", and to look at the timeliness of follow-up and corrective action (OCC Comptroller's Handbook, "Regulatory Reporting").

How do you remediate a material weakness?

Find the root cause, fix the control, and then prove the fix on enough new instances that the control can be called effective again. GAO's standards make documentation of the corrective action part of the requirement, and list what it may include: "root cause analysis", "planned actions", "interim milestones", "completion dates", measurable indicators of progress, and "the entity official responsible for monitoring the status of the corrective actions" (GAO Green Book, para. 17.06).

Timing matters under Part 363. A material weakness found in October and remediated by December 31, with the fix tested, need not appear in the management report as unremediated; one found in December almost certainly will. That is the strongest argument for testing regulatory reporting controls on live quarters through the year, which control testing automation, live before the Part 363 year-end sets out as a plan. The same file also answers an examiner who asks how management knows the fix worked.

How Regulatory Reporting Controls handles deficiencies

A deficiency agent proposes each classification, control deficiency, significant deficiency or material weakness, with its likelihood, magnitude and compensating-control reasoning written out against the bank's own severity guide. It never decides. The Controller accepts or changes each proposal with a reason, anything above a control deficiency goes to the audit committee, and every decision sits in one audit trail with its evidence. In the sample year that came to four deficiencies, none significant and no material weakness, each with its reasoning on the screen below.

Four deficiencies in a year, each with its reasoning and its decision

The point of the design is that the grade is never the agent's and never a surprise. Because every exception is raised as the control runs, deficiencies arrive one at a time through the year, not in a pile in January, and each one is decided while the people involved remember what happened. How each exception is found in the first place is covered in AI control testing vs sampling by hand.

Questions people ask

What is a material weakness, in one sentence?

A deficiency, or a combination of deficiencies, in internal control over financial reporting that creates a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. That is the SEC's definition in 17 CFR 210.1-02, and the meaning auditors apply.

Can several control deficiencies add up to a material weakness?

Yes. Both SEC definitions say "a deficiency, or a combination of deficiencies", and GAO's standards say deficiencies are evaluated individually and in aggregate. Three small deficiencies on the controls feeding regulatory capital can together be more serious than any one.

Does a material weakness have to be reported to the regulators?

For institutions with $5 billion or more in assets, an unremediated material weakness at year-end is disclosed in the Part 363 management report, which goes to the FDIC, the primary federal regulator and any state supervisor. The accountant's written communication of significant deficiencies and material weaknesses is filed with them too, within 15 days.

Is a self-reviewed reconciliation a significant deficiency?

Not by itself. It is an operating failure of the control; its grade depends on whether the balance could have been materially wrong and whether another control would have caught it. In the sample bank it tied to the cent and a variance review operated, so it was graded a control deficiency.

How long does it take to remediate a material weakness?

As long as it takes to fix the control and show it working on enough new instances. A monthly control needs several months of clean instances; a daily one fewer calendar days. Plan the re-test before the fix, so the closing date is known.