Material Weakness in Internal Control: Disclosure and Remediation

A material weakness in internal control is a flaw in a public company’s financial reporting controls serious enough that there is a reasonable possibility a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. That definition comes from Public Company Accounting Oversight Board Auditing Standard 2201.¹ When a company identifies one, management cannot conclude that internal controls are effective, the weakness must be publicly disclosed, and research consistently shows the announcement pushes the share price down.

Every phrase in the definition carries weight. “Reasonable possibility” means the chance is more than remote, not that an error is likely. “Material” means an error large enough that a reasonable investor would care. And the emphasis on timely detection means a problem can qualify even if the error would eventually be caught, because a delayed catch can still mislead the market in the meantime.

Internal control over financial reporting, usually shortened to ICFR, is the system of processes a company uses to keep its financial statements reliable: who can approve a transaction, how accounts get reconciled, how access to accounting systems is limited, how software changes are managed. A material weakness in that system does not mean an error has already occurred. It is forward-looking. It flags a vulnerability where an error could reasonably happen and could matter if it did.

Material Weakness Versus Significant Deficiency

Not every control problem crosses the line into a material weakness. The PCAOB and SEC recognize a middle tier called a significant deficiency, defined as a shortcoming less severe than a material weakness but still important enough to merit attention from those overseeing the company’s financial reporting.¹

The practical gap between the two categories is disclosure. A material weakness must appear in the company’s annual report. A significant deficiency does not. Under Section 302 of the Sarbanes-Oxley Act, the CEO and CFO must disclose significant deficiencies to the audit committee and to the outside auditors, but the investing public never sees them in the filings.² Because the classification determines whether a problem becomes public, auditors scrutinize the boundary closely, and companies often push to keep issues on the significant-deficiency side of the line.

How Auditors Decide a Deficiency Qualifies

The evaluation weighs two things together: how likely the control failure is to produce an error, and how big that error would be if it occurred.

Likelihood

The standard’s threshold is “reasonable possibility,” which the PCAOB ties to the accounting profession’s existing definitions of “reasonably possible” and “probable.”¹ Anything more than a remote chance satisfies the likelihood prong. It is a deliberately low bar. Auditors do not need to conclude that an error is probable, only that it is more than a distant theoretical risk.

Magnitude

The second prong asks how large the potential error would be. The Supreme Court has held that a fact is material when there is a substantial likelihood a reasonable investor would view it as significantly altering the total mix of available information.³ Auditors usually begin with a quantitative benchmark, but the SEC has made clear through Staff Accounting Bulletin No. 99 that relying only on a numerical threshold is not appropriate.⁴

Even a small-dollar error can be material if it masks a trend such as a decline in earnings, moves reported results past an analyst target, triggers a loan covenant breach, causes management to hit a bonus threshold it otherwise would have missed, conceals illegal activity, or is concentrated in a business segment the company has highlighted to investors. This qualitative overlay is where most classification disputes land. A $2 million error may look immaterial against a company’s total revenue, but if it turns a quarterly loss into a profit, auditors are trained to push back on any argument that it doesn’t matter.

Aggregation matters too. Several minor deficiencies that individually would not qualify can collectively add up to a material weakness when they affect the same account or the same underlying process.

Indicators That Presumptively Signal a Material Weakness

AS 2201 identifies four situations that serve as strong indicators. When any of these arises, the burden effectively shifts to the company to explain why a material weakness should not be declared.¹

Fraud by senior management, regardless of the dollar amount, because it suggests the people who set the control environment can bypass it.
Restatement of previously issued financial statements to correct a material error, which shows the original controls failed to catch the problem before investors saw the numbers.
Identification by the outside auditor of a material current-period misstatement that the company’s own controls missed.
Ineffective oversight of financial reporting and internal control by the audit committee.

The fraud indicator deserves emphasis. A CEO who overrides an approval process to push through a $50,000 transaction raises the same concern as one who manipulates revenue by $50 million. The signal is that the control environment can be circumvented by the people it most needs to restrain.

Beyond the four formal indicators, weak IT controls have become one of the most common root causes in practice. Excessive user access privileges, poor separation between development and production environments, inadequate change management for software updates, and failure to inventory all systems relevant to financial reporting regularly lead to adverse audit opinions. Strong manual review processes cannot compensate for access controls that let unauthorized users alter the underlying data those reviews rely on.

What the Company Must Disclose and When

Once a material weakness is identified, it cannot be quietly fixed in the background.

The Annual Report

Regulation S-K Item 308 requires management’s annual report on ICFR to include an assessment of whether internal controls are effective as of the fiscal year-end. If one or more material weaknesses exist, management cannot conclude that controls are effective, and it must describe the nature of each weakness. The disclosure appears in Item 9A of the Form 10-K. The report must also identify the framework management used for the evaluation, and for accelerated and large accelerated filers it must reference the auditor’s separate attestation report on ICFR.⁵

Quarterly Reports

Obligations do not pause between annual filings. Exchange Act Rule 13a-15 requires management to evaluate any change in internal controls each quarter that has materially affected, or is reasonably likely to materially affect, ICFR.⁶ After the first management report on ICFR has been filed, any material changes must be disclosed in every subsequent quarterly and annual report.⁷ Investors get updated information on whether an existing weakness is being addressed and whether new ones have surfaced.

Officer Certifications

Section 302 of the Sarbanes-Oxley Act requires the CEO and CFO to personally certify the accuracy of each quarterly and annual filing. As part of that certification, they must confirm that they have disclosed any significant deficiencies and material weaknesses to the audit committee and to the external auditors.² The personal signature means individual executives face liability if they certify a filing that conceals a control problem they knew about.

What Happens After Disclosure

Market Reaction

Disclosing a material weakness almost always hurts the stock price. Academic research covering hundreds of disclosure events has found average abnormal stock returns in the range of negative 3% to 6% in the days around the announcement, with some spillover into peer companies in the same industry. The damage continues past the initial drop. A company carrying an unresolved weakness typically faces higher audit fees, closer regulatory scrutiny, and more skeptical analyst coverage, all of which raise its cost of capital.

SEC Enforcement

The SEC has signaled that disclosure alone is not enough if the company then fails to remediate. In 2019, the agency charged four public companies that had reported material weaknesses for seven to ten consecutive annual reporting periods without meaningfully fixing them. Civil penalties ranged from $35,000 to $200,000, and one company was required to retain an independent consultant to see the fixes through.⁸ More recent actions have imposed penalties reaching $400,000 for individual companies, with conditional “springing” penalties above $1 million if remediation milestones are missed. Violations tied to a company’s failure to integrate an acquired entity’s controls after a merger have generated penalties reaching nearly $10 million.

Compliance Costs

Even without a weakness, maintaining the control environment and paying for the audit is expensive. A 2023 survey cited by the U.S. Government Accountability Office reported that single-location companies averaged approximately $700,000 in internal compliance costs, while companies with more than $10 billion in revenue averaged around $1.8 million. Companies that transition from exempt to non-exempt filer status and pick up the auditor attestation requirement for the first time see audit fees rise by a median of roughly $219,000 in the transition year.⁹ A material weakness pushes those numbers higher because remediation itself demands additional testing, documentation, and often outside consulting help.

How a Company Gets Out From Under a Material Weakness

Fixing a material weakness is not a matter of issuing a memo. PCAOB Auditing Standard 6115 sets out what a company must satisfy before an auditor can report that a previously disclosed weakness no longer exists.¹⁰ The steps run roughly as follows.

Management must identify every control needed to achieve the stated control objective, including newly implemented controls, modified controls, and existing ones already in place. It must then test both the design and the operating effectiveness of those controls, showing not just that they look sound on paper but that they are actually being performed by people with the authority and qualifications to do so. The controls must run long enough to establish reliability as of a specified date; a daily transaction-level control may need a shorter testing window than a broader governance control. And management must document all of this in a written report asserting effectiveness, backed by sufficient evidence for the auditor to evaluate.

No rule dictates exactly how long remediation should take, but the specified date on which management claims the weakness is resolved must fall after the date of the most recent annual assessment.¹⁰ In practice, most companies need at least a full reporting cycle to design new controls, put them in place, and build up enough operating history to satisfy auditors. Weaknesses rooted in IT systems or in a shortage of qualified accounting staff can take multiple years to resolve. The SEC’s enforcement actions against companies carrying weaknesses for seven or more years show that the agency does eventually run out of patience with open-ended timelines.⁸

1
Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
2
U.S. Securities and Exchange Commission. Definition of the Term Significant Deficiency
3
U.S. Securities and Exchange Commission. Assessing Materiality – Focusing on the Reasonable Investor When Evaluating Errors
4
U.S. Securities and Exchange Commission. Staff Accounting Bulletin No. 99 – Materiality
5
eCFR. 17 CFR 229.308 – Internal Control Over Financial Reporting
6
eCFR. 17 CFR 240.13a-15 – Controls and Procedures
7
U.S. Securities and Exchange Commission. Office of the Chief Accountant and Division of Corporation Finance FAQ
8
U.S. Securities and Exchange Commission. SEC Charges Four Public Companies With Longstanding ICFR Failures
9
U.S. Government Accountability Office. GAO-25-107500 – Sarbanes-Oxley Act Compliance Costs
10
Public Company Accounting Oversight Board. AS 6115 – Reporting on Whether a Previously Reported Material Weakness Continues to Exist