Control Deficiency Evaluation Template (SEC Material Weakness)

Control Deficiency Evaluation: [Entity name], [Period or deficiency ID]

Working paper for judging how severe an internal control deficiency is, alone and together with other deficiencies, and for recording who was told and how it will be fixed. It classifies each deficiency as a control deficiency, a significant deficiency or a material weakness using the definitions in SEC Regulation S-X Rule 1-02 (17 CFR 210.1-02, paragraph (a)(4)) and the evaluation approach in SEC interpretive Release No. 33-8810 (2007), Section II.B.1. It also serves companies that use the same severity scale for the UK Corporate Governance Code 2024 Provision 29 declaration, and public bodies applying GAO Standards for Internal Control in the Federal Government (Green Book, 2025 revision, Principle 17). PCAOB AS 2201 (auditor's side) and the COSO Internal Control framework are cited by name only. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, audit or accounting advice. Obtain the standard or law for the normative text.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and basis
2. Severity scale and definitions
3. Materiality and evaluation inputs
4. Deficiency description
5. Affected accounts, assertions and components
6. Likelihood: reasonable possibility
7. Magnitude of potential misstatement
8. Compensating controls
9. Indicators of a material weakness and the prudent official test
10. Aggregation with other deficiencies
11. Classification decision
12. Communication and reporting
13. Remediation plan and retest
14. Deficiency register and traceability
15. Sign-off
16. Glossary and references

1. Purpose, scope and basis

This working paper records management's evaluation of the severity of internal control deficiencies identified during [FY2026] and still relevant at the assessment date. It decides, for each deficiency and for combinations of deficiencies, whether the matter is a control deficiency, a significant deficiency or a material weakness, and it records the evidence, the reasoning, the people informed and the remediation agreed.

Scope covers controls over financial reporting for the consolidated financial statements of [Entity name] and every in-scope component listed in the scoping memo. Operational, compliance and reporting controls that the board has designated as material controls are evaluated here when a deficiency could affect financial reporting; other material-control failures are evaluated in the material controls declaration working paper (compliance/material-controls-declaration).

Corvid applies the SEC severity definitions because they bind its Form 20-F ICFR report, and it reuses the same scale for financial reporting controls in the Provision 29 declaration, so the board, the audit committee and the auditor read one set of ratings. A company that is not an SEC registrant can adopt the same scale as an internal policy; record that choice here, and treat the SEC-specific reporting steps in section 12 as optional.

2. Severity scale and definitions

A deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of their assigned functions, to prevent or detect misstatements on a timely basis. A design deficiency means a necessary control is missing or, even if it operates as designed, would not meet its objective. An operating deficiency means a well-designed control did not run as designed, or the person running it lacked the authority or competence to do so effectively.

The SEC definitions in 17 CFR 210.1-02(a)(4), summarised:

"Reasonable possibility" means the likelihood is either reasonably possible or probable, in the sense used by US contingency accounting (SEC Release 33-8810, footnote 47). The release states that the judgement can be made without putting a percentage on the probability. Severity depends on what could happen, not on whether a misstatement actually occurred.

3. Materiality and evaluation inputs

Set out the quantitative anchors and the full population of deficiencies before rating any one of them. All amounts in EUR thousand unless stated.

Sources of deficiencies included in this evaluation:

Every deficiency in the register in section 14 must trace back to one of these sources. When the external auditor reports a deficiency that management had not identified, record it here as well, because the fact that management's own monitoring missed it is evidence about the monitoring component.

4. Deficiency description

Complete one block per deficiency. The fields below are the minimum a reviewer needs to agree or challenge the rating.

Example (DEF-2026-001):

Two further deficiencies are open over the same period and are carried into the aggregation in section 10:

• DEF-2026-002 (Example): ITG-ACC-002, quarterly review of privileged access to the group ERP, not performed for the company code of Corvid Commerce Vietnam LLC (CC-VN) in Q2 2026. Three former contractors kept administrator rights for 41 days after leaving, because contractors were outside the leaver feed of ITG-ACC-003. Found by internal audit (report IA-2026-07, issued 2026-09-22). Operating deficiency, with a design gap in the leaver feed.
• DEF-2026-003 (Example): CTL-REV-004, monthly group deferred revenue roll-forward review by the head of revenue accounting. In July 2026 a delegate signed the roll-forward without investigating an adjustments line of EUR 62k, above the EUR 50k threshold. Found by internal audit testing on 2026-09-25 (workpaper TW-2026-REV-004, exception EX-01; extension to April to June found no further exceptions). Operating deficiency; no misstatement, as the adjustments were traced to signed termination notices.

5. Affected accounts, assertions and components

Use the component names of the framework stated in Document control. When the framework is COSO, cite component names and principle numbers only. The Green Book 2025 uses the same five-component, seventeen principle architecture and is public domain, so its principle titles may be cited in full.

Also note any deficiency that touches the control environment, risk assessment, information and communication or monitoring components. Deficiencies outside control activities are often pervasive: they can undermine many process-level controls at once, so they weigh more heavily in the severity judgement and in aggregation.

6. Likelihood: reasonable possibility

For each deficiency, consider the factors below, which summarise the list in Release 33-8810. Record the answer and the evidence, then reach a single conclusion: is there a reasonable possibility that the company's controls will fail to prevent or detect a misstatement of the amounts or disclosures affected?

The question at this stage is whether a misstatement of any size could go undetected, not yet whether it would be material. Magnitude is assessed separately in section 7, and the two answers combine to the rating.

7. Magnitude of potential misstatement

Release 33-8810 points to two drivers of magnitude: the amounts or total transactions exposed to the deficiency, and the volume of activity in the current period or expected in future periods. It also notes that an overstatement is generally capped by the recorded amount while an understatement can be larger, and that small errors are usually more likely than large ones.

Use a simple exposure calculation and state every input:

where $M$ is the set of months in which the control failed and $J_m$ is the gross value of manual deferral journals posted in month $m$.

Example (DEF-2026-001, EUR thousand):

The gross exposure exceeds overall materiality, so before compensating controls the deficiency could, in principle, lead to a material misstatement. A realistic upper estimate is lower: re-performance found no error, and an error would most likely affect part of a month's journals rather than all of them. Record the estimate you rely on and why. Corvid records a "reasonably possible" misstatement of up to the July journal value of EUR 1,420k, still above materiality, which means the conclusion turns on the compensating controls in section 8. For March the group roll-forward review CTL-REV-004 operated at EUR 50k precision (sample S1 in TW-2026-REV-004 passed), so the exposure that remains after compensating controls is the July month.

8. Compensating controls

Release 33-8810 describes a compensating control as one that achieves the objective of a control that failed, and requires it to operate at a level of precision that would prevent or detect a misstatement that could be material. Test both conditions and record the evidence.

Write the reasoning in a sentence or two: Corvid concludes that CTL-REV-008 would have detected any misstatement from the unreviewed journals that approached materiality, because it investigates every variance above EUR 250k and was tested as operating effectively in the affected months. The deficiency is therefore not a material weakness on its own.

A control only compensates if it does not depend on the failed control. Here CTL-REV-008 builds its expectation from billing data in the subscription system, not from the journals posted by the revenue accountant, so it is independent.

9. Indicators of a material weakness and the prudent official test

Release 33-8810 lists situations that management should treat as evidence of a deficiency and consider as a possible material weakness. Answer each one for the period, not just for the deficiency in hand.

Prudent official test. The release asks management to consider the level of detail and degree of assurance that would satisfy prudent officials in the conduct of their own affairs that transactions are recorded as needed to prepare financial statements in accordance with the applicable framework. If the deficiency, alone or combined, might stop such an official from reaching that view, treat it as an indicator of a material weakness.

Record the answer as a short paragraph. Example: "A prudent official reviewing the US revenue process, knowing that two months of journals went unreviewed but that the group roll-forward review covered March and group analytics at EUR 250k precision operated in every month, would still have reasonable assurance that revenue is recorded properly. The test does not indicate a material weakness."

10. Aggregation with other deficiencies

Release 33-8810 asks management to evaluate deficiencies that affect the same financial statement amount or disclosure, or the same component of internal control, to decide whether together they amount to a material weakness. Multiple deficiencies over the same amount raise the likelihood of a misstatement even when each one is minor.

Write one paragraph per group explaining the result. Example AGG-01: "Both deficiencies weaken the review of the same balance in the same month, July 2026, and both arose because a reviewer was absent without effective cover. Neither alone could plausibly cause a material error, because CTL-REV-008 operates at EUR 250k precision. Together they left the group reliant on a single analytical backstop for a presumed fraud-risk account. Management judges this important enough to merit the attention of the audit committee and rates the combination a significant deficiency. It is not a material weakness because the backstop was tested and is precise enough."

11. Classification decision

When the evaluator and the reviewer disagree, record both views and the final decision maker. When the external auditor reaches a different rating, record the auditor's view, the reasons for any remaining difference and how the audit committee was informed.

12. Communication and reporting

SEC reporting (Corvid, Form 20-F). Item 308(a)(3), mirrored for foreign private issuers in Form 20-F Item 15(b), requires disclosure of any material weakness identified by management and bars an "effective" conclusion when one exists. Release 33-8810 adds that management should not qualify its conclusion ("effective except for") and should consider disclosing the nature of the weakness, its impact on financial reporting and on internal control, and current remediation plans, distinguishing pervasive weaknesses from narrower ones. Significant deficiencies are not required in the Item 308(a) report but are disclosed to the auditor and the audit committee under the certification rules. Item 308(c) asks for disclosure of material changes in internal control in the last fiscal quarter (Form 20-F Item 15(d): the period covered by the annual report), which can include remediation of a material weakness. A company that uses this scale without being an SEC registrant can skip this paragraph.

Example communications log:

13. Remediation plan and retest

A deficiency counts as remediated at the assessment date only when the redesigned or restored control has operated for a long enough period and has been tested with satisfactory results. Set the minimum operating period by control frequency before remediation starts, so the deadline for a clean year-end position is known.

Mind the calendar. A control for December operates in the January close, so no retest of December can finish before the year end. Base the remediation conclusion on retests of the months that can be tested before year end (here October and November, completed by 2026-12-15), and then confirm the December operation in roll-forward testing completed before the assessment is signed (here by 2027-01-31).

For a deficiency still open at the assessment date, keep the year-end rating, record the expected remediation date and carry it into the next period's register. Never re-rate a deficiency downwards at year end because remediation is "in progress".

14. Deficiency register and traceability

Traceability to the material controls declaration: CTL-REV-004 and CTL-REV-007 support material control MC-003 (revenue and deferred revenue) in compliance/material-controls-declaration; ITG-ACC-002 supports MC-007 (access to financial systems). The declaration working paper cites these IDs and the remediation evidence, and the ICFR management assessment (compliance/icfr-management-assessment, section 9) carries the same register.

Summary at the assessment date (Example): three deficiencies identified during the year; one aggregated significant deficiency (AGG-01); no material weaknesses; all three remediated by 2026-12-31, with remediation retests completed by 2026-12-15 and the December operation confirmed in roll-forward testing completed by 2027-01-31.

15. Sign-off

16. Glossary and references

References (obtain current versions):

• 17 CFR 210.1-02(a)(4), definitions of material weakness and significant deficiency (Regulation S-X), eCFR.
• 17 CFR 229.308 (Regulation S-K Item 308), management's report on internal control over financial reporting, eCFR; SEC Form 20-F, Item 15 (foreign private issuers).
• 17 CFR 240.13a-14, 13a-15, 15d-14 and 15d-15 (Exchange Act rules on certifications and controls).
• SEC Release No. 33-8810; 34-55929; FR-77, "Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934", dated 2007-06-20, effective 2007-06-27.
• GAO, Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721, 2025-05-15, effective from fiscal year 2026; supplement GAO-26-109325.
• UK Corporate Governance Code 2024 (FRC), Provisions 25 and 29, and the accompanying Corporate Governance Code Guidance (names only).
• PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements; ISA (UK) 265 (names only).
• COSO Internal Control, Integrated Framework (2013) (name only).
• Related templates: ICFR Management Assessment (compliance/icfr-management-assessment), Risk and Control Matrix (compliance/risk-control-matrix), Control Testing Workpaper (compliance/control-testing-workpaper), Material Controls Declaration (compliance/material-controls-declaration), Audit Committee Report (finance/audit-committee-report), Fraud Risk Assessment (compliance/fraud-risk-assessment).

Standard and licence note

Based on public US law and guidance: SEC Regulation S-X Rule 1-02, Regulation S-K Item 308 and SEC Release No. 33-8810 (US government works), with the GAO Green Book 2025 (US government work) as the public-domain internal control reference, all summarised in original wording. The UK Corporate Governance Code 2024, PCAOB AS 2201, ISA (UK) 265 and the COSO Internal Control framework are cited by name and number only; no text, definition or illustration from them is reproduced or paraphrased. This template is not affiliated with or endorsed by the SEC, GAO, FRC, PCAOB, IAASB or COSO. All names and figures in the examples are fictional. This template is original text written for this collection. Check the current official versions before use. Template licence: MIT.