What do internal-control disclosures in a 10-Q actually tell you?
Every 10-Q requires management to state whether any changes in internal controls occurred during the quarter. Most of the time, this section reads as boilerplate reassurance—"no material changes; everything is fine." But when management signals a problem here, even a modest one, the market and forensic investors perk up. This article shows you how to read that signal, what language matters, and why internal-control disclosure in a quarterly can be an early warning before a restatement.
Quick definition: Internal controls are the systems, policies, and procedures a company puts in place to ensure the reliability of its financial reporting, prevent error and fraud, and safeguard assets. Management must assess whether these controls are operating effectively and disclose any changes or deficiencies in the 10-Q.
Key takeaways
- A statement that no material changes have occurred is normal; changes or "remediation efforts" are red flags.
- Management is required to disclose any material weaknesses or significant deficiencies discovered during the quarter.
- The difference between "remediation in progress" and "remediation completed" signals urgency and risk.
- Watch for repeated mentions of the same control issue across multiple quarters—it suggests the problem is persistent.
- A sudden spike in disclosure or a CEO/CFO change tied to control issues often precedes a restatement.
- The 10-Q discloses control changes and problems that the 10-K will detail fully in Item 9A.
Part 1: Where to find internal-control disclosure in a 10-Q
The 10-Q does not require management to perform the full SOX 404 assessment that a 10-K demands. However, management must disclose, in Item 4 of the 10-Q (labeled "Controls and Procedures" or similar), any material changes in internal controls or any material weaknesses or significant deficiencies discovered during the quarter.
This section is typically located near the end of the 10-Q document, after the condensed financial statements and notes, sometimes just before or after the Item 3 (Quantitative and Qualitative Market Risk Disclosures).
The language is often brief—a few paragraphs—but the absence of disclosure (or its presence) is what matters. A company that says nothing new about controls is signaling stability. A company that discloses a newly discovered issue is signaling risk.
Part 2: The standard "no material changes" language
The majority of 10-Qs begin the controls section with something like:
"Management has evaluated, with the participation of our Chief Executive Officer and Chief Financial Officer, the effectiveness of the design and operation of our disclosure controls and procedures... No material changes in internal control over financial reporting occurred during the quarter ended [date] that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting."
This sentence is the baseline. It is not suspicious—it is expected. Most quarters, most companies will report no material changes. This is the null hypothesis: the controls are stable, nothing broke, nothing is being fixed in an urgent way.
When you read that sentence, ask: Is that all it says? If so, move on. The company is signaling that nothing new or urgent has happened on the control front.
Part 3: Red flags—material changes and remediation disclosures
The red flags appear when management deviates from the boilerplate:
"Material weakness identified" or "Significant deficiency discovered" — This means management has found a control that does not work as designed. A material weakness is severe; a significant deficiency is less severe but still notable.
"Remediation efforts underway" or "We are implementing corrective actions" — This language signals that management found a problem and is actively working to fix it. The key question: Did they remediate it during the quarter, or is the fix still in progress?
"Remediation measures have been completed" or "The control has been redesigned and tested" — This is less alarming. Management found a problem, fixed it, and tested the fix. The risk is lower because the control is now operating.
"We expect to fully remediate by [date]" — This is a delay signal. The problem exists, the fix is not yet complete, and the company is guiding on when it will be done. This is riskier because the deficiency is active now.
The appearance of the same control issue in consecutive quarters — If a company discloses the same remediation effort in Q1 and again in Q2, without a statement that it has been completed, the problem is persistent. This is a yellow flag that the issue is harder to fix than management expected, or that management is not prioritizing it.
Part 4: Material weakness vs significant deficiency
The hierarchy matters:
Material weakness: A deficiency (or combination of deficiencies) such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, on a timely basis. Material weaknesses are rare and serious. If disclosed in a 10-Q, they are almost always acknowledged again in the 10-K Item 9A audit opinion, and the auditors will likely qualify their opinion.
Significant deficiency: A deficiency (or combination of deficiencies) that is important enough to merit attention by those responsible for oversight of financial reporting, but not so severe as to constitute a material weakness. It is less severe but still noteworthy.
When a company discloses a material weakness in a 10-Q, the stock often moves down immediately. Investors interpret this as a signal that the company's reported earnings might be unreliable. A significant deficiency is less alarming but still merits scrutiny.
Part 5: Changes in CEO or CFO as a control signal
The 10-Q controls section sometimes mentions changes in key personnel—specifically, the CEO, CFO, or Chief Accounting Officer. This matters because when a company changes its top accounting or finance officer, control risk rises temporarily.
The disclosure might read: "Due to the resignation of our former Chief Financial Officer, there was a temporary increase in control risk during the period prior to the appointment of the new CFO. We are evaluating the adequacy of our control environment."
This is a yellow flag. It does not mean fraud is imminent, but it means there is a gap in oversight. A long gap (several months) is worse than a short one. And if the company also discloses a control deficiency around the same time the CFO departed, it raises questions: Did the previous CFO hide the problem? Did the new CFO discover it?
Part 6: Interaction with the audit and the 8-K
If a company discloses a material weakness or significant deficiency in a 10-Q, two things typically follow:
-
The auditors will likely comment in their 8-K or review opinion. If the control deficiency is material enough, the auditors may qualify their review opinion on the 10-Q financial statements, or they may include a paragraph noting the deficiency.
-
The 10-K will elaborate. When the company files its 10-K later that year, the controls section (Item 9A) will provide much more detail on the issue, what caused it, how it is being remediated, and what testing is ongoing.
Smart investors therefore read the 10-Q control disclosure, then immediately check the auditors' review opinion on the 10-Q financial statements. If the auditors say "We have no material modifications to the control deficiencies disclosed by management," that is reassuring. If they say "We are not providing any assurance over the design or operation of internal controls," that is a warning that the auditors are distancing themselves.
Part 7: Control changes that are not deficiencies
Not all control changes are bad. Sometimes a company discloses that it has:
- Upgraded its accounting system or IT infrastructure
- Implemented a new control to address a risk that was not previously controlled
- Refined a control process to make it more efficient
- Hired new internal audit staff or expanded the internal audit function
These are positive disclosures. They signal that management is proactively investing in the control environment, not just reacting to problems. Read the language carefully: If the company is "implementing" a new control to address an identified risk, that is proactive. If it is "remediating" a control that failed, that is reactive.
Part 8: The disclosure control and procedures vs internal control over financial reporting distinction
The 10-Q requires two separate assessments:
-
Disclosure controls and procedures (DC&P): Controls designed to ensure that information required to be disclosed in reports filed with the SEC is recorded, processed, and reported on a timely basis. This includes not just the financial statements, but also the MD&A, risk factors, and all other required disclosures.
-
Internal control over financial reporting (ICFR): The controls that ensure the financial statements are prepared in accordance with GAAP and that the transactions and events that underlie those statements are recorded, processed, and reported accurately.
A company might disclose a deficiency in ICFR (e.g., a control over the closing of certain accounts) without disclosing a deficiency in DC&P. Or it might find a DC&P problem (e.g., a process for updating the MD&A is incomplete) without an ICFR issue.
When reading the 10-Q, look for both assessments. If management says DC&P and ICFR are both operating effectively, the controls are sound. If either one is flagged, that is a yellow flag.
Real-world examples
Example 1: A control deficiency tied to IT infrastructure
Apple's 10-Q for Q1 FY2024 disclosed: "During the quarter, we identified and implemented enhanced controls over the close process for certain financial statement line items. The enhanced controls are designed to ensure completeness and accuracy of data in our financial reporting system. We have tested the new controls and are satisfied that they are operating effectively."
This is a positive disclosure. Apple is saying: We found a small gap, we fixed it, and it is working. No material weakness, no significant deficiency, no red flag.
Example 2: A persistent remediation effort
A smaller company discloses in Q1: "We identified a significant deficiency in the design of our account reconciliation process for revenue. We are implementing a new accounting system to remediate this deficiency. We expect the remediation to be completed by the end of Q3."
Same company in Q2: "The significant deficiency identified in Q1 is still being remediated. The new system is in development, and we expect completion in Q3."
Same company in Q3: "The remediation is substantially complete, and we have begun testing the effectiveness of the new controls."
The pattern here is: a known problem, active remediation, and a timeline for completion. This is not ideal, but it is transparent. The risk is that if Q4 comes and the company has not completed remediation, the pattern suggests management is not executing on its promises.
Example 3: A sudden material weakness disclosure
A fintech company discloses in Q2: "We have identified a material weakness in our internal control over financial reporting related to the completeness and accuracy of transactions in our digital payment systems. The weakness arose due to the rapid growth of our transaction volumes and the limitations of our current transaction monitoring system. We are implementing a new monitoring system and additional manual controls, with full remediation expected by year-end."
This is a serious disclosure. The company is admitting that its controls broke under pressure from growth. The risk is that if transaction volumes continue to rise faster than the new controls can handle, the company might restate. Investors should watch the next 10-Q closely to see if management confirms that the new controls are working.
Common mistakes
Mistake 1: Ignoring control disclosures because they use boilerplate language Many investors skip the controls section because it "always says the same thing." But that is exactly the wrong instinct. The controls section is worth reading precisely because most of the time it is boilerplate. When it deviates—when there is actual disclosure of a change or deficiency—that deviation is a signal. Do not dismiss it.
Mistake 2: Confusing "remediation in progress" with "remediation complete" A company that discloses "we are implementing corrective actions" is not the same as one that discloses "the corrective actions have been tested and are operating effectively." The first is a yellow flag; the second is reassuring. Read the verb tense carefully.
Mistake 3: Not cross-checking with the auditors' opinion If management discloses a control deficiency in the 10-Q, the next thing to do is read the auditors' review opinion on those financial statements. If the auditors have qualified their opinion or noted the deficiency, that adds weight to the disclosure. If the auditors say nothing, it suggests they view the issue as minor. Both scenarios are informative.
Mistake 4: Overlooking control changes tied to personnel changes When a CEO, CFO, or Chief Accounting Officer leaves, there is often a temporary increase in control risk. If the departure is sudden or unplanned, the risk is higher. Always check whether a personnel change is mentioned in the controls section.
Mistake 5: Not reading the 10-K Item 9A for deeper context The 10-Q controls section is brief. The 10-K Item 9A is much more detailed. If you see something flagged in a 10-Q, do not just note it and move on. Six months later, when the 10-K is filed, read Item 9A to see the full context and what management did (or did not) about it.
FAQ
Q: If a company says there are no material changes in controls, does that mean the controls are perfect? A: No. It means there were no material changes during the quarter. A company could have had a material weakness last year (disclosed in last year's 10-K Item 9A) but be reporting "no material changes" in this quarter, meaning the weakness persists. Always check the prior year's 10-K Item 9A to see if there are outstanding issues.
Q: Can a company have a material weakness in a 10-Q but not in the 10-K? A: Yes, if remediation is completed between Q4 and the year-end. A company might disclose a material weakness in Q3's 10-Q, then complete remediation and test it by year-end, and have no material weakness in the 10-K. This is not unusual and is less concerning than a weakness that persists.
Q: What should I do if a 10-Q discloses a material weakness? A: First, read the full disclosure to understand what the weakness is and what remediation is planned. Second, check the auditors' review opinion to see if they have commented. Third, hold the stock pending the next quarterly or annual filing to see whether remediation has progressed. Fourth, consider whether the weakness affects an area material to the financial statements (e.g., revenue recognition, account reconciliation) or something less critical (e.g., the physical count of a small inventory location). Material weaknesses in core processes are more serious than those in peripheral ones.
Q: How much weight should I give a significant deficiency vs a material weakness? A: A material weakness is a serious issue that warrants active concern. A significant deficiency is less severe but still indicates control risk. If you are holding the stock and a significant deficiency is disclosed, it does not necessarily mean you should sell, but it is reason to monitor more closely. If a material weakness is disclosed, that is a stronger signal to either exit or require credible evidence of remediation before holding further.
Q: If management says a control has been "remediated," should I believe it? A: Partially. Management's claim of remediation is a starting point, not an end point. The auditors will test the remediated control during their audit and will report in the 10-K whether they believe it is operating effectively. If the 10-K audit opinion says the control is now effective, that is more credible than just management's claim in the 10-Q. Always wait for auditor confirmation.
Q: Why would a company not disclose a control deficiency if one existed? A: A company might fail to disclose a deficiency due to incompetence, negligence, or intentional concealment. If a company later restates or is caught by an auditor for a control failure, it signals that prior management knew or should have known. This can lead to enforcement actions by the SEC. As an investor, if you suspect a company is hiding a control problem, that is a strong reason to be skeptical of the financial statements overall.
Related concepts
- Auditor review opinion on 10-Q financial statements — The auditors' letter assessing whether they are aware of any modifications to the control deficiencies disclosed by management.
- SOX 404 assessment — The full annual assessment of internal control over financial reporting that management must conduct for 10-Ks, but a scaled-down version applies to 10-Qs.
- Critical audit matters (CAMs) — Audit-determined areas of significant attention, which sometimes overlap with control deficiencies disclosed by management.
- Restatement risk — A company with disclosed control deficiencies has elevated restatement risk, particularly if the deficiency affects revenue, receivables, or inventory.
- COSO framework — The common framework that defines and assesses internal control effectiveness; understanding COSO helps you interpret what management is assessing.
Summary
Internal controls are the unglamorous backbone of reliable financial reporting. When a 10-Q says "no material changes," that is normal and requires no action. But when management discloses a newly identified deficiency, a material weakness, or an ongoing remediation effort, you have a signal that something is broken or was broken. The key to reading this section is patience: Do not skip it because it is boilerplate, and do not overreact to every mention of a control issue. Instead, distinguish between transient problems (found, fixed, tested) and persistent ones (repeated disclosure across quarters, or a material weakness left unfixed). Cross-check with the auditors' review opinion and the prior 10-K Item 9A to build a complete picture. A company that transparently discloses control deficiencies and makes concrete progress on remediation is less risky than one that tries to hide the problem or promises fixes that never materialize.