Control deficiency

A control deficiency occurs when a security or operational control is either missing or fails to operate as intended. This means the control cannot reliably prevent or detect errors, fraud, or unauthorized activities within an organization. It represents a failure in the design or execution of a risk mitigation measure.

In practice

An auditor identifies this during testing when they find evidence that a required process was skipped, such as discovering several new employee accounts that were created without the mandatory manager approval signature.