Deficiency Severity Is a Risk Judgment, Not a Mood
Classify SOX deficiencies using likelihood, magnitude, compensating controls, and oversight significance.
The move: evaluate exposure, not embarrassment. SOX deficiency severity is a judgment about what the control failure could allow, not just what it actually caused. A control can fail without a recorded misstatement and still be serious if a material error could reasonably have gone undetected. The severity questions Ask four questions: What control objective failed? What misstatement could result? How large could that misstatement be? What is the reasonable possibility it would not be prevented or detected on time? Then assess whether precise compensating controls reduce the exposure. Why compensating controls are hard A compensating control must address the…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in