Material weakness vs significant deficiency
Both are internal control problems; severity separates them. A significant deficiency is serious enough to deserve the attention of those charged with governance. A material weakness is severe enough that a material problem could go undetected. In audit year 2024, 2,088 of 22,398 nonprofit single audits (9.3%) reported a material weakness (data as of 2026-09-20).
Last verified: 2026-09-20 · Every figure links its source.
What is a material weakness, and what is a significant deficiency?
In a single audit both terms are used for internal control over compliance with the requirements of a major program, and both are reportable findings (2 CFR 200.516(a)(1)). The severity test comes from the auditing standards the auditor applies under Government Auditing Standards: a deficiency exists when a control does not allow problems to be prevented or detected in the normal course of work; it is significant when it merits the attention of those charged with governance; it is a material weakness when there is a reasonable possibility that material noncompliance would not be prevented or detected in time.
| Significant deficiency | Material weakness | |
|---|---|---|
| Severity | Merits governance attention | Material problem could go undetected |
| Reported as a finding | Yes | Yes |
| Blocks low-risk auditee status | No, on its own | Yes — 200.520(c) requires no material weaknesses in both prior periods |
| Share of nonprofit audits, 2024 | 13.5% | 9.3% |
Source: 2 CFR 200.516 · GAO Government Auditing Standards · 2 CFR 200.520 · Federal Audit Clearinghouse · Last verified: 2026-09-20
How does the auditor decide which one it is?
By the possible consequence, not by the size of the transaction that exposed it. One unallowable cost found in a sample can be a material weakness if the control that should have caught it does not exist at all; a larger error can be a significant deficiency if compensating controls make a material failure unlikely. The finding itself has to explain the condition, the criteria, the cause, the effect and the questioned costs, which is what lets a reader judge the severity for themselves (2 CFR 200.516(b)).
Source: 2 CFR 200.516 · Last verified: 2026-09-20
What happens after a material weakness finding?
- Management writes a corrective action plan naming a contact person, the action and the anticipated completion date (2 CFR 200.511(c)).
- Low-risk auditee status is lost for the next two audit periods (2 CFR 200.520), which raises required major program coverage from 20 percent to 40 percent of federal awards expended (200.518(f)) and usually the audit fee with it.
- The federal awarding agency or pass-through entity issues a management decision on the finding and follows up (2 CFR 200.521 — see also 200.513 on cognizant and oversight agency roles).
- The finding carries into next year's summary schedule of prior audit findings, where its status must be reported honestly — misrepresenting it is itself a finding (200.516(a)(7)).
Source: 2 CFR 200.511 · 2 CFR 200.520 · 2 CFR 200.518 · 2 CFR 200.513 · Last verified: 2026-09-20
How common are these findings among nonprofits?
Across 22,398 nonprofit single audits for audit year 2024: 3,631 reported at least one finding (16.2%), 2,088 a material weakness (9.3%), 3,027 a significant deficiency (13.5%) and 1,255 a repeat finding (5.6%). 13,812 (61.7%) were treated as low-risk auditees. Data as of 2026-09-20; one row per organization and audit year in our copy of the Federal Audit Clearinghouse bulk data.
Source: Federal Audit Clearinghouse · Last verified: 2026-09-20
Questions and answers
What is the difference between a material weakness and a significant deficiency?
Severity. A significant deficiency merits the attention of those charged with governance; a material weakness means there is a reasonable possibility that material noncompliance would not be prevented or detected in time.
Does a material weakness stop us being a low-risk auditee?
Yes. Low-risk auditee status requires that no material weaknesses were identified in either of the two preceding audit periods.
Comparing firms after a finding? See firms that audit nonprofits.
This is public-record information, not accounting or legal advice.