What belongs in a control deficiency register
A practical list of fields that keep financial control findings usable for owners and external auditors.
A register that only lists “improve approvals” helps no one. When we open a control deficiency logging file, we insist on fields that survive the hand-off to remediation owners and to the statutory auditor.
Minimum columns
- Reference — a stable ID that does not change when rows are sorted
- Cycle — revenue, inventory, payroll, treasury, journals, or disclosures
- Control statement — the control as designed, in one sentence
- Condition / criteria / cause / effect — the four-part finding body
- Severity — significant deficiency or lesser weakness, with a short rationale
- Owner and target date — a named person inside the client organisation
- Evidence location — where supporting papers live (folder, binder, or shared drive path)
Optional but useful
Prior year reference, related financial statement assertion, and a “auditor visibility” flag noting whether the point already appeared in a management letter. These columns stop duplicate debate in the first week of fieldwork.
What to leave out
Long policy extracts pasted into every row. Keep policy references short and attach the full document separately. The register should be readable in a single audit committee sitting.