#material weakness

Most financial statement errors do not start with fraud. They start with a control that was supposed to catch a mistake and did not.

Each publicly held corporation is obligated to have internal control over financial reporting in place. But material weakness still arises year after year from SEC reports. As per an SEC EDGAR data analysis conducted by Baker Tilly, more than 15% of filers were found to have reported material weaknesses in their internal controls in 2024. This percentage is even more significant in the boom years of 2021 when more than 25% of filers reported such weaknesses in their internal controls.

But why do well-structured controls fail in real-world practice? This problem always finds its solution in certain root causes, not in one culprit only.

What Internal Controls Are Actually Supposed to Do

Internal controls are the checks and processes a company builds to make sure its financial statements are accurate and complete. They cover things like:

Who can approve a journal entry

How revenue gets recognized and recorded

How account reconciliations get reviewed

Who has access to financial systems

The most widely used framework for this is the COSO Internal Control Integrated Framework, which most US public companies rely on to design and assess their controls. Under Section 404 of the Sarbanes-Oxley Act, management must assess the effectiveness of these controls, and larger companies also need an external auditor to attest to that effectiveness.

On paper, this sounds thorough. In practice, controls break down in a few predictable ways.

Root Cause 1: Segregation of Duties Gets Ignored

One person should not be able to initiate a transaction, approve it, and record it in the books. This is one of the oldest ideas in accounting, yet it remains one of the most common failure points.

Smaller finance teams are especially exposed here. When the headcount is tight, the same person often ends up wearing three hats. Recent SEC filings from smaller and newly public companies repeatedly cite segregation of duties failures as a driver of material weaknesses, particularly around incompatible duties that were never separated or reviewed on time.

This is not usually intentional. It is what happens when a company grows faster than its finance department.

Root Cause 2: Controls Are Designed for Yesterday's Business

A control that works fine for a simple, single product company often cannot handle a complex financing arrangement, a new revenue stream, or an acquisition. Several 2025 SEC filings describe this exact pattern: controls that were not built to identify or account for non-routine, unusual, or complex transactions.

The issue is not always missing control. Often the control exists, but nobody updated it after the business changed. A revenue recognition process built for straightforward product sales does not automatically work for subscription revenue or multi-element contracts.

Root Cause 3: Lack of Technical Accounting Expertise

Complex accounting standards require judgment. Companies that lack staff with deep technical accounting knowledge tend to misapply guidance rather than ignore it outright. This shows up in filings as a stated reason for a material weakness: insufficient personnel with the expertise to handle a specific transaction correctly.

This root cause connects directly to the kind of mistakes covered in our related piece on typical financial reporting mistakes. Errors born from misapplied guidance rarely show up as a single mistake. They tend to repeat across multiple reporting periods until someone with the right expertise catches them.

Root Cause 4: Oversight of Third Parties Breaks Down

A number of organizations have taken outsourcing certain segments of the process of financial reporting to accountants, consultants or even service providers. Failure by the organization to examine this third-party work closely is what results in mistakes being recorded directly into the organization’s financial records.

This trend has become very common, such that it has been listed as an entirely different material weakness in recent 10-K reports under the name of ineffective oversight of third parties used to assist in financial reporting process.

Root Cause 5: Remediation Takes Longer Than Expected

Even after a company recognizes its weak spot and develops an appropriate solution, that solution must operate for some time to ensure testing. The absence of the particular transaction type during the test period will prevent companies from verifying the effectiveness of the solution, leaving the weak spot exposed. There are many filings from 2025 reporting just this case.

This is why control failures often linger. It is not always a sign management is ignoring the problem. Sometimes the business itself has not generated enough activity to confirm the new control actually holds up.

How These Root Causes Turn into Financial Statement Errors

None of these five root causes are exotic. They are ordinary operational gaps: not enough people, not enough expertise, not enough oversight, and not enough time to prove a fix works.

But when a control fails silently, the error it was supposed to catch does not just disappear. It moves downstream into the financial statements, where it can trigger:

Restated prior period financials

Delayed filings

Loss of investor confidence

Increased audit fees and scrutiny in future periods

Strong financial reporting controls are what stand between a small process gap and a public restatement. When those controls are missing, understaffed, or outdated, the errors that follow are rarely a surprise to anyone who understands how the control environment was built.

What Finance Teams Can Do About It

There is no single fix that solves all five root causes, but a few practices consistently reduce the risk:

Review segregation of duties whenever the team grows or restructures, not just once a year

Update control design whenever a new transaction type, product line, or financing structure is introduced

Build a pipeline for technical accounting questions to reach someone qualified before the transaction is recorded, not after

Treat third-party work as an input to review, not a finished product

Give new controls enough time and enough real transactions to be properly tested before declaring them remediated

Getting internal controls right is less about adding more paperwork and more about matching controls to how the business operates today.