§ 04Deficiency severity analysis
Each deficiency is evaluated against the PCAOB framework: likelihood
(reasonable possibility) × magnitude (could result in material
misstatement). The combination, not either alone, drives the
classification.
Severity matrix · deficiencies
| Control |
Likelihood |
Magnitude |
Classification |
| REV-03 Tenant concessions |
Reasonably possible |
Inconsequential |
Deficiency |
| P2P-04 3-way match review |
Reasonably possible |
Inconsequential |
Deficiency |
| ITG-02 User access review |
Reasonably possible |
More than inconsequential
|
Significant deficiency |
| ITG-04 Privileged access |
Reasonably possible |
Material |
MW candidate |
Recommendation summary
-
REV-03, P2P-04: management response &
remediation plan; no opinion impact.
-
ITG-02: elevate to
significant deficiency — communicate to
audit committee in writing.
-
ITG-04: pending closing meeting outcome; if MW
confirmed, ICFR opinion would be
adverse at the relevant assertion level.
-
All identified deficiencies are
operating effectiveness in nature; control design
assessed as adequate.