What A Material Weakness Actually Looks Like Before Anyone Calls It One

The phrase arrives late. A material weakness is named at the end of a process, usually by someone external, usually in writing. What it looked like for the years before that is far less dramatic, and far more familiar.

It looked like a workbook that worked. Built by somebody capable, because the reporting was a mess and somebody had to sort it out. Extended each time a new question was asked. Never documented, because the person who built it did not need documentation and nobody else was using it.

The early symptoms, in the order they usually appear

One person owns the file. Not formally. It is simply understood that they are the one who runs it, and that understanding has never been written down or challenged.

Some cells are load-bearing and everyone knows which. Or rather, one person knows. The knowledge of what is safe to touch is real, detailed, and stored nowhere.

Questions about figures get deferred. Not refused. Deferred. "I will come back to you on that" is the most reliable early indicator there is, because it means the answer exists but not in the room.

Two reports disagree and it gets parked. Somebody notices, the difference is immaterial, and it is left. The reason it was left is that settling it would take an evening nobody has.

None of these is a failure. Each one is a sensible response to a real constraint. Together they describe a control environment that depends on an individual, which is exactly what the finding will eventually say.

Why it is usually found from the outside

Because from the inside it looks like competence. The reporting goes out on time. The figures are, in fact, usually right. The person running it is good at their job, and the evidence for that is that nothing has gone wrong.

An external reviewer is not testing whether the numbers are right. They are testing whether you can demonstrate that they are right, which is a different question and the one the file was never built to answer.

What closes the gap

Demonstrability, which is narrower and cheaper than it sounds. It does not mean new controls, a new system, or a documented process for everything the finance team does.

It means that for each figure in the pack, somebody can say which file it came from, which cell, how it is derived and when it last changed, without leaving the meeting. That is the artefact an external reviewer is looking for, and it is also the thing that lets you hand the pack to somebody else.

It is worth building before anyone asks for it, for the simple reason that building it under deadline, with a reviewer waiting, is the most expensive moment to start.