Thirdly, the remediation of failed tests
should be based on the severity level of the
failures; only material weaknesses require
remediation and retesting. CTI remedied all
test failures in Europe, even though management
qualified none of them as material weaknesses.
CTI did this because they did not know
how the auditor would qualify failures, and
CTI’s auditor did not evaluate the severity of
failures until after year end. This was not
uncommon: in their evaluation of audit firms’
methodologies, the PCAOB found that “in
several cases, auditors identified control defi-
ciencies early in the process but did not
evaluate their severity until after year-end”
(PCAOB, 2005, p. 14).