The most cost-effective strategy in dealing with control deficiencies is to keep them to an absolute minimum. However, the severity of control deficiencies must be evaluated once either of the following circumstances occurs: (1) A conclusion is reached that a deficiency in design exists that has not been satisfactorily remediated as of year-end; and (2) Exceptions to testing results are evaluated following the completion of all remediation and retesting efforts.

We believe that assessing and classifying control deficiencies is a process. This sample questionnaire can be used by auditors to efficiently assess and classify an organization’s control deficiencies.