An auditor pulls a sample, finds one missing approval, and pauses. Does that missing approval mean the control failed? Not necessarily. The exception is a finding from testing; the auditor still needs to evaluate what it means for the control's design or operation and the related risk. Under PCAOB AS 2201, identified control deficiencies are evaluated based on factors such as the reasonable possibility and potential magnitude of a misstatement.
The distinction matters because getting it wrong in either direction can create problems. Treat every exception as a deficiency, and you may generate unnecessary findings, remediation work, and client friction. Dismiss a genuine deficiency as an isolated exception, and you may overlook a control weakness that could allow a material misstatement to go undetected.
In this article, I will walk you through the difference between a control exception and a control deficiency, how auditors evaluate the gap between them, and where that evaluation commonly goes wrong.
What Is a Control Exception?
A control exception is a deviation identified during control testing. The exception itself does not establish whether the control is deficient or ineffective; the auditor must evaluate the underlying condition, related risk, and other relevant evidence.
Control exception observations generally consist of the following components:
Expected control attribute: What the control was expected to demonstrate, such as documented reviewer approval.
Test procedure: The method used to evaluate the control, such as inspection, observation, inquiry, or reperformance.
Evidence obtained: The documentation, system record, or other evidence collected for the sample item.
Deviation from the expected attribute: The condition where the evidence does not meet the expected control requirement.
Documentation of the exception: A clear record of what was tested, what was expected, and what was identified.
Examples of Control Exceptions
Examples of control exceptions include a review performed outside the required timeframe, a control action performed without appropriate authority, a control performed by someone without the necessary knowledge or competence, or a transaction that was not processed according to a prescribed procedure.
Identifying an exception does not by itself establish a control deficiency. The auditor should consider the nature and cause of the exception, whether it is isolated or recurring, the related risk, and the interaction with other controls before reaching a conclusion.
What Is a Control Deficiency?
A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. Under PCAOB AS 2201, a deficiency in design exists when a necessary control is missing or is not properly designed, while a deficiency in operation exists when a properly designed control does not operate as designed or the person performing it lacks the necessary authority or competence.
Design Deficiency
A control deficiency may occur if the control does not exist, or if it does exist, it is designed or implemented in a way that does not allow it to meet the objective for which it was established.
For example, a company may have a journal-entry review control, but the control may exclude certain high-risk journal entries that should be subject to review. If the control is not designed to address the relevant risk, it may represent a design deficiency.
Operating Deficiency
An activity may be designed to meet a control objective but fail to achieve that objective because the control is not performed as designed. For example, a reconciliation control may be appropriately designed, but if the required reconciliation is not performed, the control may have an operating deficiency.
Control Deficiency vs Control Exception: What's the Difference?
Factor | Control Exception | Control Deficiency |
What is it? | A deviation identified during control testing | A deficiency in the design or operation of a control |
When identified? | During control testing | After evaluating the underlying condition and its effect on the control |
Automatically a deficiency? | No | It is already an evaluated deficiency |
Main focus | What did not meet the expected test criteria? | What does the underlying condition indicate about the control's design or operation and related risk? |
Requires investigation? | Yes | Yes |
Can be isolated? | Yes | It may be isolated or part of a broader issue |
Severity evaluation | May lead to further evaluation | May require evaluation of severity and interaction with other deficiencies |
The simplest way to remember it: an exception is an observation, and a deficiency is an evaluation.
Why a Control Exception Does Not Automatically Mean a Control Deficiency
A control exception can occur for a variety of reasons and does not always indicate the existence of a control deficiency.
The exception may be isolated
If control deviations are found to be isolated, auditors should evaluate the nature and extent of the control exceptions and determine their effect on the control. It may be appropriate to modify the nature, extent or timing of other tests of controls to address control exceptions.
The evidence gap may not mean the control failed
The absence of evidence in the expected location does not by itself establish that the control did not operate. Evidence may be stored elsewhere or may require additional investigation. The auditor should evaluate the available evidence and determine whether it supports the conclusion that the control operated as intended.
Related controls may address the same risk
If a control exception occurs due to the absence of one control, it may be compensated for by the presence of another control. The auditor must evaluate the compensating control.
Additional testing may change the conclusion
Auditors may perform additional testing to assist management in evaluating whether an exception to a control is isolated. In such situations, the PCAOB expects the auditor to evaluate the effect of the exception on the control and the evidence supporting that evaluation.
The key point to remember: An exception starts the evaluation process; it does not automatically establish a control deficiency.
How Auditors Evaluate a Control Exception
Identify exactly what failed: Start with the specific control attribute that was not met, rather than broadly stating that “the control failed.”
Validate the exception: Confirm the population, sample, evidence, timing, control requirement, and applicable period before proceeding.
Determine the root cause: Determine whether the issue relates to control design, execution, documentation, a system dependency, training, authority, or a process change.
Determine whether the issue is isolated: Look across other samples, periods, control performers, locations, and similar controls to identify potential patterns.
Map the exception to the underlying risk: Ask what could go wrong if the control does not operate as intended, and connect the issue to the control objective or relevant assertion.
Evaluate related and compensating controls: Consider whether other controls address the same risk and whether any compensating control operates with sufficient precision to mitigate the issue.
Determine the appropriate conclusion: An isolated exception may not indicate a control deficiency. A recurring or systemic issue may require further evaluation. The conclusion should be based on the applicable audit framework and the evidence gathered.
Isolated Control Exception vs Recurring Control Failure
An exception is an identified deviation from the expected control requirement. Whether an exception is isolated or indicative of a broader control issue depends on factors such as its cause, pattern, frequency, affected population, and relationship to the underlying risk.
For example, if one of 30 samples contains a deviation, the auditor should investigate whether the issue is isolated or reflects a broader problem with the control. If exceptions appear across multiple samples, periods, control performers, or locations, the auditor may need to perform additional procedures to determine whether there is a recurring or systemic issue.
Exception frequency alone does not determine significance. Under PCAOB AS 2201, the evaluation considers factors including the nature of the deficiency, its interaction with other controls or deficiencies, and the reasonable possibility and potential magnitude of a resulting misstatement.
How Compensating Controls Affect the Evaluation
A compensating control is another control that addresses the same or a similar risk. The existence of a compensating control does not by itself eliminate an underlying control deficiency.
However, the auditor should consider the effect of compensating controls when evaluating the severity of a deficiency or combination of deficiencies. Under PCAOB AS 2201, a compensating control must operate with sufficient precision to prevent or detect a misstatement that could be material in order to have a mitigating effect.
Common Mistakes When Evaluating Control Exceptions
Treating every exception as a failed control: An exception should not automatically trigger a control failure conclusion. Exceptions should be analyzed and investigated.
Skipping the root cause: Without determining the cause of an exception, an auditor is unable to assess its significance.
Focusing only on documentation: Absence of supporting documentation for a control does not necessarily mean that the control has been compromised.
Expanding testing without a purpose: Perform additional testing when the results, risk, or available evidence indicate that further procedures are needed to support the evaluation.
Ignoring related controls: Related or compensating controls can affect the risk evaluation.
Judging by exception count alone: One or several exceptions do not determine the conclusion by themselves.
Assuming no misstatement means no deficiency: A deficiency can exist based on the reasonable possibility of a misstatement, even when none actually occurred.
Example: Evaluating a Control Exception From Testing to Conclusion
The control requires a finance manager to review journal entries over $50,000. The auditor tests 30 transactions and finds 2 without documented evidence of review.
Identify the exception: Two of 30 sampled entries lack evidence of the required review.
Validate the evidence: Evaluate if the review was performed, but evidence was placed elsewhere.
Investigate the cause: Determine whether the review occurred without documentation or was not performed.
Perform targeted additional testing: Assess if the same situation occurs in other sampled populations or reviewers.
Assess related controls: Determine if other controls cover the same risk.
Evaluate the risk: Determine the potential impact if the control is not in place.
Document the conclusion: Record whether the evidence supports an isolated exception or indicates a broader design or operating issue.
Two exceptions, by themselves, do not determine whether a control deficiency exists. The auditor must evaluate the nature and cause of the exceptions, the related risk, the evidence obtained, and the interaction with other controls before reaching a conclusion.
How Roz Supports Control Exception Review and First-Pass Control Testing
Evaluating exceptions well takes time, time spent tracing evidence, reviewing sample sets, and documenting reasoning. Roz is built to reduce that manual burden while keeping the auditor in control of the conclusion.
Map evidence to control requirements: Roz connects relevant evidence to the controls and testing criteria they support, so auditors are not searching across disconnected files.
Identify potential exceptions: AI-powered testing runs attribute checks against evidence and sample sets, surfacing potential exceptions for auditor investigation.
Surface missing or contradictory evidence: Evidence review and sufficiency checks help surface documentation that is missing, incomplete, or potentially inconsistent.
Generate a first-pass testing result: Roz runs defined or AI-suggested attribute checks and returns PASS, FAIL, N/A, or INFO outcomes, along with the reasoning behind each result.
Link findings back to source evidence: Quote Highlighting lets auditors jump directly from an AI-generated result to the exact supporting passage, so results can be verified quickly.
Surface items requiring auditor review: Potential exceptions and unclear evidence remain available for direct auditor investigation and override. Roz accelerates the first pass, not the final judgment.
Maintain an audit trail: Testing activity, reruns, verifications, and overrides are logged, supporting reviewability and defensibility.
Conclusion
An exception is an observation identified during testing. A control deficiency is identified through the evaluation of a control’s design or operation. Understanding the exception, identifying its cause, and determining whether it is isolated or part of a broader pattern help auditors evaluate its significance and relationship to the underlying risk. Auditors should also consider related controls and other relevant evidence before reaching a conclusion.
The evaluation of control deficiencies requires professional judgment and consideration of the applicable audit framework, evidence, and related risks.
Frequently Asked Questions
What is the difference between a control deficiency and a significant deficiency?
A significant deficiency is a control deficiency, or a combination of control deficiencies, that is less severe than a material weakness but is important enough to merit the attention of those responsible for oversight. The assessment considers the nature and potential magnitude of the related misstatement risk
What is the difference between a control deficiency and a material weakness?
A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting that presents a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. It is therefore more severe than a control deficiency that does not rise to the level of a material weakness.
Can multiple control exceptions become a deficiency?
Yes. Control exceptions may be evaluated individually, but auditors should also consider whether multiple exceptions indicate a broader control issue, particularly when they relate to the same risk, related controls, or multiple periods. The number of exceptions alone does not determine whether a control deficiency exists.
What is the difference between a design deficiency and an operating deficiency?
An operating deficiency occurs when a properly designed control does not operate as designed or is performed by someone who lacks the necessary authority or competence. A design deficiency occurs when a necessary control is missing or an existing control is not properly designed to achieve its control objective.
