Which term describes a deficiency in the design or operation of a control that could allow misstatements to go undetected?

• A. Detective control
• B. Corrective control
• C. Control self-assessment
• D. Control weakness

Answer: (D)

A control weakness means there is a deficiency in how a control is designed or how it operates, such that misstatements could slip by without being detected in a timely way. Controls are put in place to prevent, detect, or correct errors and fraud. If a control isn’t properly designed or isn’t functioning as intended, it creates an opportunity for mistakes to occur and remain hidden.

For example, if there’s no independent review of journal entries, incorrect or fraudulent postings could go unnoticed, which is a weakness in the control environment.

This differs from a detective control, which is specifically meant to catch problems after they occur, a corrective control, which addresses and fixes issues after detection, and control self-assessment, which is the process of evaluating controls rather than a type of deficiency.