Sarbanes Oxley Act states that management needs to assess the internal controls and report any deficiencies in control. In the words to follow, I will try and explain the concept of control deficiency. A control deficiency can be a deficiency in design or a deficiency in operation. Such control deficiencies prevent management from performing their functions properly and in detecting misstatements.

A deficiency in Design may occur due to

- An control neccesary to meet the control objective is missing

- An existing control is not properly designed, as a result even if it operates it does not achieve the control objective.

A deficiency in Operation may occur due to

- A properly designed control does not work as designed

- The person responsible for executing the control lacks the neccesary qualifications and authority to perform the control.

Keep the above basic definition of control deficiency in mind when you are evaluating whether a control has failed in operation or in design. It is very rare that a control will fail both in operation as well as in design. But the same is possible, I have seen it in companies I have been involved with in their 404 implementation.