Aggregation to control weaknesses 438



  • How is everyone aggregating their insignificant control weaknesses in order to determine whether or not a significant deficiency or material weakness in controls exists? This seems to be a difficult task as it is hard to assign a score to a weakness for the purposes of adding them up to see if they amount to anything significant. In most cases, the weaknesses we have identified could have a high probability of occurance with a varying range of financial errors, but I can’t see anything material getting through our high-level review processes. Small amounts could possibly get through the high-level reviews, so we have not listed them as mitigating controls.
    I’m curious as to what others are doing in this area.



  • This post is deleted!


  • And that is the USD64,000 question.
    This is a conversation/argument you will have to have with your auditor. An approach would be to categorise your control deficiencies as to liklihood of error and potential size of error and systematically address this starting from the highest impact.
    Look for:

    1. Compensating controls
    2. Mitigating factors
    3. Substabtive oricedures to prove that errors have not occured.

Log in to reply