CISA· ISACA
Certified Information Systems Auditor (ISACA)
ISACA’s CISA targets IS audit. 5 domains, ITAF and COBIT, 2,300+ questions with AuditBot explanations.
Term DefinitionControls
Control Deficiency
A flaw in the design or operation of an internal control.
A control deficiency exists when a control is poorly designed (design deficiency) or fails to operate as intended (operating deficiency). It is classified as a simple deficiency, significant deficiency, or material weakness depending on severity per PCAOB AS2201. Classification guides the prioritization of remediation efforts. Deficiencies are identified through design testing (walkthroughs) and operating effectiveness testing (TOE). Each identified deficiency must result in a remediation plan with an assigned owner and deadline.
📌 Key points
- Two types: design deficiency (control cannot work) and operating deficiency (it doesn't work in practice)
- Severity hierarchy: simple deficiency → significant deficiency → material weakness
- Significant deficiencies and material weaknesses are communicated to the audit committee
- Material weaknesses require public disclosure in SOX reports
- A documented remediation plan is required for each identified deficiency
Related certifications
These certifications cover the concept of "Control Deficiency" in depth.
CIA· IIA
Certified Internal Auditor (IIA, 3 Parts)
The IIA CIA certification covers this concept in Part 1 (framework, IPPF) and Part 2 (audit practice). 60+ lessons and 1,258 original questions.
CIA Challenge· IIA
CIA Challenge Exam (1-exam route)
Accelerated 8-week path for CCSA/CFSA/CGAP/CRMA/ACCA/CPA/CIMA holders. A single 150-question exam instead of all 3 Parts.
🔗 Related concepts
ControlsControlsComplianceControlsControls
Material Weakness
A severe deficiency that could result in a material misstatement of financial statements.
Significant Deficiency
A deficiency less severe than a material weakness but requiring management attention.
SOX Compliance
Requirements of the Sarbanes-Oxley Act to prevent financial statement fraud.
Control Objective
A statement of what a control aims to ensure.
IT General Controls (ITGC)
Foundational controls supporting the reliability of information systems.
📖 Related articles
Master this concept and more
Start your GRC certification journey today.