Control deficiencies are defined in Audit Standard No. 2 and are important enough to warrant a separate discussion. A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal performance of their duties and functions, to detect or prevent a misstatement from occurring on a timely basis. A deficiency in design exists when a control required to achieve the control objective is missing or the existing control is not properly designed, causing the control objective to be missed. Deficiencies in operation result when a properly designed control fails to operate as it was designed or when the person performing the control does not have the necessary authority or qualifications to perform the control effectively. It is important to realize that these two factors design and operating effectiveness need to be met to avoid a deficiency.

A significant deficiency is a control deficiency, or a combination of deficiencies, that can affect the company's ability to initiate, record, process, or report external financial information on a reliable basis in accordance with GAAP. The deficiency occurs when there is more than a remote likelihood that an inconsequential misstatement of the company's annual or interim financial statements either will not be prevented or will not be detected.

The term remote likelihood follows FAS No. 5, which spells out the following three categories:

1. Probable means that a future event or events are likely to occur

2. Reasonably possible is when the chance of a future...