Control deficiency

A control deficiency exists when a control is designed or operated in a way that does not prevent, or detect and correct, misstatements on a timely basis, or when a necessary control is missing. The auditor evaluates significance and communicates deficiencies as required. A deficiency may arise from poor design, non-operation, or the absence of a control needed to prevent or detect misstatement. Its significance depends on the likelihood and potential magnitude of a misstatement, not solely on whether an error has already occurred.