Blog / Deficiencies

Deficiencies

What to do when a SOX control test fails: how to raise the deficiency, classify its severity correctly, and see it all the way through remediation and retest.

Severity comes down to two questions: how likely a misstatement is, and how large it could be. The guides here walk through the difference between a control deficiency, a significant deficiency and a material weakness, why several small findings in the same account can add up to something more serious, which qualitative factors push a classification up, and who should make the final call. They also cover getting a deficiency from found to closed: finding the root cause, designing the fix, letting it operate for at least one full cycle, and retesting it before it can be closed.

Start with the deficiency classification guide. For how a deficiency is tracked from the first exception to closed in SOXLayer, see audit trail and deficiency management.