Common material weakness examples include letting developers keep administrative access to the general ledger, having no documented process for reviewing complex multi-element revenue contracts, running a finance team too thin to handle specialized accounting standards, and failing to reconcile shipping and inventory records at period-end. Each is a gap serious enough that a company’s financial statements could contain a meaningful error nobody catches in time. What follows walks through what these failures look like in practice, where they tend to cluster, and what happens once one is disclosed.
What Counts as a Material Weakness
A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting where there is a reasonable possibility that a material misstatement of the company’s financial statements won’t be prevented or detected on time.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Under PCAOB standards, “reasonable possibility” covers events that are either reasonably possible or probable. The misstatement doesn’t have to have actually occurred, and it doesn’t have to be likely. The gap itself is the finding.
That is what separates a material weakness from a lesser control deficiency or a significant deficiency. It sits at the top of the severity scale, and once a company has even one, management cannot say its internal controls are effective.
Four Common Examples
Unrestricted Access to Financial Systems
One of the most frequently reported material weaknesses involves failing to control who can access and modify data in financial systems. Picture a company where software developers keep administrative access to the production environment that houses the general ledger. Nobody monitors their activity. No separate approval is required before changes take effect.
The problem isn’t that someone committed fraud. It’s that no preventive control stops unauthorized changes to financial records, and no detective control would catch them afterward. That combination creates a reasonable possibility of undetected misstatement, and that is enough. The remediation typically involves role-based access controls, periodic access reviews, and logging that flags unusual activity. Access-related IT general control weaknesses have been trending upward in recent years and now sit among the most commonly disclosed findings.
No Formal Process for Reviewing Complex Revenue Contracts
Revenue is the line investors watch most closely, and it is where judgment calls create the most room for error. A material weakness arises when a company has no documented process for reviewing multi-element sales contracts. Without a structured review, the accounting team may fail to identify separate performance obligations within a contract, or may allocate the transaction price incorrectly among them.
The result is revenue booked in the wrong period or the wrong amount. A software company that bundles licenses, implementation services, and ongoing support into a single contract needs a systematic way to separate those elements. When the only process is the controller reading the contract and making a judgment call, the control environment has a hole large enough to drive a restatement through.
Insufficient Accounting Staff and Technical Expertise
This one shows up frequently at smaller public companies and at organizations that have recently gone through mergers or adopted new accounting standards. A finance team of three people may include nobody with deep expertise in derivative instruments, business combinations, stock-based compensation, revenue recognition under ASC 606, or lease accounting under ASC 842. The problem compounds when management leans on the external auditor to identify errors rather than catching them internally first.
The weakness is structural. Management cannot reliably assess whether complex GAAP requirements have been applied correctly. Fixes usually involve hiring specialized personnel, engaging outside technical consultants, or both.
Broken Inventory Cutoff Procedures
In the inventory cycle, a material weakness often traces to a breakdown in period-end cutoff, where goods, revenue, and cost of goods sold aren’t recorded in the same period. A shipment that leaves the warehouse on the last day of the quarter but stays on the inventory books until the following month overstates ending inventory and distorts cost of goods sold.
The missing control is usually a reconciliation between shipping records and inventory records at period-end, performed by someone independent of the warehouse. When that reconciliation never happens, or happens without follow-up on the discrepancies, cutoff errors accumulate into material amounts.
Where These Failures Cluster
Material weaknesses tend to fall into four groups, and recognizing the pattern helps when reading a company’s disclosures.
Entity-level controls set the tone for the whole organization: governance, risk assessment, and the overall control environment. When these fail, the damage rarely stays confined to one account or one cycle.
IT general controls underpin every automated financial process. They cover user access security, program change management, and data processing integrity. A breakdown here calls the reliability of every downstream system into question.
Business process controls are the transaction-level controls in specific cycles like revenue, inventory, accounts payable, and treasury. Breakdowns here are often traceable to a single missing step, such as an unsigned reconciliation or an unenforced approval threshold.
Accounting and financial reporting expertise is the fourth cluster. Complex standards demand specialized knowledge, and when a finance team doesn’t have it, even well-designed controls fail because nobody notices the guidance is being applied incorrectly. This is especially common at companies whose transaction complexity has outpaced their accounting department.
What Has to Be Disclosed
Once a material weakness is identified at a public company, several disclosure obligations kick in.
Section 404(a) of the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of internal controls over financial reporting each year. SEC Regulation S-K, Item 308 sets out what the disclosure must include: management’s assessment of ICFR effectiveness as of fiscal year-end, along with disclosure of any material weakness identified.2eCFR. 17 CFR 229.308 – (Item 308) Internal Control Over Financial Reporting If even one material weakness exists, management cannot conclude internal controls are effective. The assessment appears in the annual Form 10-K.
Accelerated and large accelerated filers face an additional requirement under Section 404(b): their external auditor must independently attest to ICFR effectiveness. Non-accelerated filers are exempt from this attestation, though they still must complete the management assessment. When the auditor does attest and finds one or more material weaknesses, PCAOB standards require an adverse opinion on internal controls rather than a qualified one.1Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements An adverse opinion is a definitive statement that internal controls are not effective.
The disclosure obligation continues quarterly. SEC rules require management to evaluate changes in internal controls each quarter and disclose material changes in both quarterly and annual filings.3eCFR. 17 CFR 240.13a-15 – Controls and Procedures A material weakness discovered mid-year, or significant progress on remediation, surfaces in the Form 10-Q rather than waiting for the annual report.4U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Disclosure in Exchange Act Periodic Reports Frequently Asked Questions Separately, Section 302 requires the CEO and CFO to personally certify disclosure controls in every quarterly and annual filing and to disclose all significant deficiencies and material weaknesses to the auditors and audit committee.
What Happens After Disclosure
The disclosure itself is where the real consequences start.
Restatements are the most immediate risk. A material weakness often surfaces alongside, or shortly before, a restatement of previously issued financial statements. In early 2026, Driven Brands Holdings disclosed material weaknesses and simultaneously announced it would restate financials covering multiple fiscal years. The company’s stock dropped nearly 40% on the day of the announcement, and a securities fraud class action lawsuit followed within weeks.
Research on material weakness disclosures over multi-year periods has found that while the announcement-day reaction can appear modest, companies tend to experience substantial negative drift over the following two quarters, with annualized underperformance in the range of 10 to 16 percent. That slow bleed can be more damaging than a single sharp drop because it erodes shareholder value over months rather than giving investors a clear exit point.
Beyond stock price, disclosure can trigger increased SEC scrutiny, higher audit fees as the auditor expands testing, and difficulty raising capital. Lenders and investors treat an adverse opinion on internal controls as a red flag, and the company may face higher borrowing costs or tighter covenants until remediation is complete.
How Companies Fix a Material Weakness
Remediation is not a quick patch. Management typically starts with a formal plan identifying the specific controls to be added or modified, process changes, technology investments, and personnel training. For the system access example, that might mean deploying a user access review tool, reassigning developer permissions, and establishing quarterly recertification. For the revenue example, it might mean a contract review checklist and hiring a technical accounting specialist.
Implementation alone isn’t enough. The new controls must operate effectively over a testing period before the weakness is considered resolved. A transaction-based daily reconciliation can demonstrate effectiveness fairly quickly. An entity-level control or one tied to period-end financial reporting typically has to be tested in connection with at least one period-end close, because that is the only time the control actually runs.5Public Company Accounting Oversight Board. AS 6115 – Reporting on Whether a Previously Reported Material Weakness Continues to Exist Most remediations span at least one full quarter, and many extend across a complete fiscal year before both management and the auditor are satisfied.
A material weakness is considered resolved only when management asserts it no longer exists as of a specified date, and the auditor obtains sufficient evidence to agree. That specified date must fall after the date of management’s most recent annual ICFR assessment.5Public Company Accounting Oversight Board. AS 6115 – Reporting on Whether a Previously Reported Material Weakness Continues to Exist Roughly a third of companies that report a material weakness in a given year end up reporting one again in a later year, which shows how hard sustained remediation can be. The external auditor is required to communicate all material weaknesses to the audit committee in writing, so the committee is the body monitoring whether the plan, the timeline, and the budget are realistic.6Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements