Remediating a material weakness after a failed audit means four things:

1. Understand the finding: exactly which control failed, and why it matters.

2. Find the root cause: whether the control was missing, badly designed, or not operated as designed.

3. Fix it: change the control, and assign an owner and a deadline.

4. Prove it works: run the new control long enough to produce evidence, test it, and report the result to those charged with governance.

The terms and reporting rules differ by country, but the remediation work follows the same principles.

For example: the auditor’s letter arrives three weeks after year-end. It reports that a property company’s controls over lease accounting failed to catch errors in straight-line rent and tenant improvement allowances, and the financial statements had to be corrected.

The controller’s first question is how to make the letter go away. The better question is how to make sure next year’s audit finds a control that works.

What is a material weakness?

The term depends on where you are and what kind of company you are.

In the United States, for companies reporting to the SEC, a material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there’s a reasonable possibility that a material misstatement of the company’s annual or interim financial statements won’t be prevented or detected on a timely basis.

In countries that follow the International Standards on Auditing, usually through their own national versions and local rules, the auditor’s communication is governed by ISA 265. It uses the term “significant deficiency”: a deficiency, or combination of deficiencies, that in the auditor’s professional judgment is important enough to merit the attention of those charged with governance. ISA 265 requires the auditor to communicate significant deficiencies identified during the audit to those charged with governance in writing, on a timely basis.

Either way, the finding means one or more controls didn’t do their job, and the people overseeing the company now know it.

Which weaknesses are common in property companies?

Property finance has its own pressure points. Areas worth checking include:

• Lease accounting: straight-line rent, tenant allowances and lease modifications, under the applicable accounting framework. This isn’t new. A 2005 annual report describes a material weakness in controls over accounting for leasehold improvements, tenant allowances and leases with scheduled rent escalations, which led to restated financial statements.

• Reconciliations: bank, rent roll and, where your jurisdiction requires them, trust account reconciliations that are late, incomplete or not reviewed.

• Segregation of duties: one person able to both initiate and record transactions. RIOO’s guide to segregation of duties by portfolio size covers how to fix this at different team sizes.

• Journal entries: manual entries posted without independent review.

• Recoveries: CAM or service charge reconciliations calculated outside the system, with no review.

• System access: users with more access than their role needs.

The four-step remediation

This is the framework: understand, find the root cause, fix, prove.

1. Understand the finding

Read the auditor’s letter closely, then meet the auditor to clarify:

• which control or process failed

• what the auditor saw: a missing control, a badly designed one, or one that wasn’t performed

• what evidence the auditor would expect to see for a working control

Correct any errors in the financial statements straight away, but don’t build the permanent fix until you agree on the problem. A remediation aimed at the wrong control won’t clear the finding. Designing the fix is management’s job. The auditor stays independent of it.

2. Find the root cause

ISA 265 describes a deficiency as either a control that’s missing, or one that’s designed, implemented or operated in a way that can’t prevent, or detect and correct, misstatements on a timely basis. Use those categories to find the real cause:

Many findings have more than one cause. A lease accounting weakness, for example, can combine a missing review with a team that hasn’t been trained on the standard.

3. Fix it

Write a remediation plan. For each finding, record:

• the root cause

• the change to the control

• the owner

• the target date

• the evidence the new control will produce

Keep the fix proportionate. A single missing review can be fixed quickly. A weakness rooted in skills or systems takes longer, and the plan should say so honestly.

4. Prove it works

A redesigned control isn’t remediated until it has operated, and produced evidence, for long enough to be tested. That usually means:

• Run the new control through enough cycles, such as several month-end closes, to show it works consistently.

• Test it yourself first. Have someone independent of the control check the evidence.

• Report progress to those charged with governance, such as the board, the audit committee or the owners, so they can see the plan moving.

Management is responsible for the fix, and for assessing whether it works. The auditor’s role depends on the engagement. In a U.S. audit of internal control over financial reporting, the auditor independently evaluates whether controls are effective. In a financial statement audit under ISA 265, the auditor communicates deficiencies it identifies, without giving an overall opinion on internal control. Either way, clear evidence makes the next audit straightforward.

What should the remediation plan show?

Who’s involved?

How do you stop it happening again?

Remediation fixes one finding. Preventing the next one takes a habit: review your key controls every year, not just after an audit. Check that each one still exists, still matches how the team actually works, and still produces evidence. Changes such as a new system, a reorganization or a new type of lease are the most common moments for a control to quietly stop working.

RIOO’s guide to building a month-end close checklist shows how review steps and owners can be built into the close itself, so controls run as part of the work, not alongside it.

Where RIOO fits

RIOO is property management software built directly on NetSuite.

• Approvals and audit logs. RIOO’s Finance & Accounting system enforces role-based approvals, so no payment goes through without the right sign-off, and it keeps audit logs of transactions. That gives remediated controls a record the auditor can test.

• Access by role. RIOO uses role-based access controls to limit what each employee can do, which supports the segregation of duties many remediation plans depend on.

Note: This blog is general guidance, not audit, legal or accounting advice. Auditing standards and reporting rules differ by country and by type of company. Work with your auditors and advisers on any finding. Last reviewed October 2026.

Frequently asked questions

Q1. What is a material weakness in internal control?
In the United States, for SEC-reporting companies, it’s a deficiency, or combination of deficiencies, in internal control over financial reporting that creates a reasonable possibility a material misstatement won’t be prevented or detected on time.

Q2. Is a material weakness the same as a significant deficiency?
They’re related but different. In the U.S., a material weakness is more severe than a significant deficiency. In countries that follow the International Standards on Auditing, ISA 265 uses “significant deficiency” for a deficiency important enough to merit the attention of those charged with governance.

Q3. How long does it take to remediate a material weakness?
It depends on the cause. A missing review can be fixed quickly. But the new control usually has to operate for several cycles, such as month-end closes, before it can be tested and considered remediated.

Q4. Who decides whether a material weakness has been remediated?
Management designs and implements the fix, and assesses whether it works. In a U.S. audit of internal control over financial reporting, the auditor also independently evaluates whether the controls are effective. In a financial statement audit under ISA 265, the auditor communicates deficiencies it finds rather than giving an overall opinion on internal control.

Q5. What should a remediation plan include?
For each finding: the root cause, the change to the control, the owner, the target date, and the evidence the control will produce, plus regular status updates.

Q6. What are common material weaknesses in property companies?
Lease accounting (straight-line rent, tenant allowances and modifications), late or unreviewed reconciliations, weak segregation of duties, unreviewed journal entries, and CAM or service charge recoveries calculated outside the system.

Q7. Who needs to be told about a material weakness?
The auditor communicates significant deficiencies to those charged with governance, such as the board, the audit committee or the owners. Public companies may also have disclosure requirements under their securities regulators’ rules.

Q8. How can property companies prevent material weaknesses?
Review key controls every year, especially after system changes, reorganizations or new types of leases, and make sure each control has an owner, a clear standard and evidence that it’s performed.