Page 135 - CITP Review

Material weakness
Material weakness (MW). A material weakness is a deficiency, or combination of deficiencies, in internal
control, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected in a timely basis. A reasonable possibility
exists when the likelihood of an event occurring is either reasonably possible or probable.

Aggregation of deficiencies

One key factor in assessing deficiencies is to aggregate them, for much the same reason and in much
the same way as financial auditors aggregate misstatements. A single deficiency may not represent a
significant impact on assurance of certain audit objectives, but the aggregate of several control
deficiencies of small risk could represent a SD or MW. Per AU-C section 450, the auditor must consider
revising the overall audit strategy and audit plan should the aggregate of misstatements approach
materiality, or if the aggregate of misstatements indicates that other misstatements are present.

Materiality — Impact to the entity

SAS Nos. 107 and 109 have been previously discussed, complete with an illustration on how to assess
the RMM. Documentation of the risk assessment and resulting materiality is required for each relevant
account, class of accounts, and disclosures. That evidence must include the relevant assertions on those
objects.

Risk of material misstatement

For the CITP, the RMM process begins with the identification of IT risks where the IR is beyond some
established threshold of tolerance (for example, moderate or high IR). Then, the CITP will examine CR
related to that IT risk, to determine if management has adequately reduced the RMM to an acceptable
level. That is:

RMM = IR × CR

© 2019 Association of International Certified Professional Accountants. All rights reserved. 3-51