Significant deficiency
Also known as: Control deficiency, Internal control gap
A significant deficiency is a flaw in an organization's internal controls that is more serious than a minor error but less severe than a material weakness. It indicates that a control is missing or operating incorrectly, creating a reasonable possibility that a misstatement or security breach could occur. Because of its risk level, it must be reported to management and those charged with governance.
In practice
An auditor may identify this when they find that while most user access requests are documented, several high-privileged accounts were created without formal approval. This is flagged in the audit report as a gap that requires remediation to prevent future unauthorized system changes.