Another question, 111.04, clarifies the reporting actions required for both a significant deficiency and a material weakness. An auditor's statement of a material weakness is a reportable event, the SEC says. On the other hand, a report of a significant deficiency or deficiencies in internal control, which doesn't also say that the company had a material weakness, isn't automatically a reportable event.

What's the difference?

A material weakness gives rise to the "reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis," and is equivalent to saying that the internal controls needed to develop reliable financial statements don't exist, the SEC says. In contrast, a significant deficiency is a "deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant's financial reporting," . A significant deficiency doesn't automatically mean that an organization can't produce reliable data, Deiso says.

However, the CD&I went on to say that the presence of a significant deficiency could reasonably lead one to conclude that other reportable events have occurred. For instance, it's possible that the auditor needed to expand the scope of the audit due to the deficiency. The need for an expanded audit could be a reportable event, Deiso notes.