How to Evaluate an Internal Control Deficiency

Here is how to grade what you find.

What a deficiency actually is

A control is missing, or it exists but does not work.

Those are different problems. A missing control needs designing. A control that exists on paper and is skipped in practice needs enforcing, and usually means the control was impractical.

Ask which one you have before you fix anything.

Grade by two questions, not by instinct

First, could this let a material error or loss happen? Not did it. Could it.

Second, how long would it run before anyone noticed?

A gap that could produce a large loss and would surface next month is less serious than a small one that could run for three years. Duration compounds.

The three severity levels

Minor. Could produce an error, but the amount is small and something downstream would catch it. Note it, fix it when convenient.

Significant. Could produce an error large enough to matter, and detection depends on someone happening to look. Fix it this quarter.

Material weakness. Could produce an error that changes your reported position, and nothing in your process would reliably catch it. Fix it now. This is also the type your auditor will raise formally.

The compensating control question

Before you grade something severe, ask what else would catch it.

If the owner reviews every payment over AED 10,000 personally, a weak approval process below that threshold is less serious than it looks.

But be honest about whether the compensating control actually operates. "The owner looks at the bank statement" only counts if the owner actually looks, every month, at a statement they receive directly.

Where they cluster

In owner-managed UAE businesses, almost always the same four.

Segregation of duties, because there are not enough people.
Bank detail changes accepted by email without verification.
Approval limits that have not moved since the business was a third of the size. Access rights in the accounting system never removed when someone changes role.

The last one is invisible and universal. Check who can post journals in your system today. The list will surprise you.

What to do with the results

Write them as a table. Deficiency, could it cause a material problem, how long before detection, compensating control, action, owner, date.

One page. The purpose is a decision about each item, not a document.

Why this matters more now

Your auditor evaluates controls as part of the audit, and reports significant findings in the management letter.

Most owners never read that letter. It is a free list of your control weaknesses, already graded by someone independent. Read last year's before you commission anything new.

Where we fit

We run control reviews and produce that one-page table. If you already have a management letter, start there instead. It costs you nothing.