Plain definition
A control deficiency exists when a control is missing, poorly designed, not operating as intended, or unable to address its stated risk. It may arise from an unclear rule, weak evidence, an automated configuration error, lack of competence, or a review that is performed too late. The label identifies a condition; the seriousness depends on likelihood, possible impact, and other controls.
Finding a deficiency does not by itself prove a loss, fraud, or reporting error. It calls for a reasoned assessment of exposure and a response that is proportionate to the risk.
Illustrative example
Suppose the monthly review of supplier-bank-detail changes is designed to be performed by the controller. During an internal review, the controller finds that reports were generated but nobody compared the changes to verified supplier contacts for three months. The finance director assesses which payments were affected, asks for an immediate review of the changes, and assigns an independent person to perform the monthly comparison while the process is repaired.
The deficiency is not “the report existed.” It is that the designed review did not operate. The evidence identifies the exposure period and gives management a basis for deciding whether wider investigation or disclosure is needed.
A deficiency should be described precisely enough to distinguish a one-off mistake from a design or operating weakness.
Why it matters
It prevents management from accepting a control as effective merely because a system produces a report or a policy names a reviewer.
It helps prioritise remediation by connecting the weakness to a specific risk and affected population.
Practical consequence
State the intended control, the observed failure, the period affected, the risk, and the evidence before choosing a remedy.
Assign containment and remediation separately where needed, then test the repaired control on a live or safely simulated cycle.