Learn · Explainer

Internal control and material weaknesses

What management's internal control report says, what a material weakness is, with Apple's and Super Micro Computer's 10-Ks.

The short answer

Internal control over financial reporting is the set of processes a company uses to make sure its financial statements are reliable: approvals, reconciliations, system access limits and reviews. Each year management reports whether those controls were effective, in Item 9A of the 10-K. A material weakness is a gap serious enough that a material misstatement might not be prevented or caught in time, and if one exists management can't call its controls effective.

What the 10-K has to say

Under Item 308 of Regulation S-K, the annual report includes management's report on internal control: a statement that management is responsible for it, the framework used to judge it (almost always COSO 2013), and management's conclusion on whether it was effective at year end. Large accelerated and accelerated filers also include their auditor's opinion on the same question. Item 9A also covers disclosure controls, the processes for getting information into filings on time, and any change in internal control during the last quarter.

Three levels of problem

Control deficiency: a control doesn't work as intended. Common and usually not disclosed.
Significant deficiency: less severe than a material weakness but important enough to tell the audit committee.
Material weakness: defined in Rule 12b-2 as a deficiency, or a combination, such that there is a reasonable possibility a material misstatement won't be prevented or detected on a timely basis. It has to be disclosed, and management can't conclude controls are effective while one exists.

A material weakness doesn't mean the numbers are wrong; it means the process can't be relied on to catch an error. It's often followed by extra audit work, a later filing date or, sometimes, restated figures.

Two real conclusions

Effective. Apple's 10-K for fiscal 2026 states that management concluded its internal control over financial reporting was effective as of Sep 26, 2026, and the auditor agreed. That's the usual wording.

Not effective. Supermicro's 10-K for the fiscal year ended Jun 30, 2024, filed in February 2025, concluded the opposite. It listed five material weaknesses, among them IT general controls for some financial systems, controls over segregation of duties that weren't properly designed and implemented, and the review and approval of manual journal entries. It said none had been remediated as of the filing date, and set out a plan to fix them.

What to look for

The conclusion sentence in Item 9A, for both internal control and disclosure controls.
New versus repeat weaknesses. A weakness carried for more than a year suggests remediation is hard.
Remediation steps, such as new hires, system changes and board oversight, and later reports saying the weakness is fixed.
The auditor's opinion on controls, part of the auditor's report for larger companies.

Common questions

What is internal control over financial reporting?

The processes a company uses to make its financial statements reliable, such as approvals, reconciliations and access controls. Management reports on them in Item 9A of the 10-K.

What is a material weakness?

A deficiency, or a combination of deficiencies, creating a reasonable possibility that a material misstatement won't be prevented or caught in time.

Does a material weakness mean the financial statements are wrong?

No. It means the controls can't be relied on to prevent or catch a material error. Sometimes it's followed by restated figures, often not.

Does the auditor check internal control?

For large accelerated and accelerated filers, yes: the auditor gives its own opinion on whether internal control over financial reporting was effective.

Where is the internal control report in a 10-K?

In Item 9A, Controls and Procedures, with the auditor's opinion near the financial statements in Item 8.

Disclosures

Editor holdings: The editor holds no position in any company named on this page. As of Nov 11, 2026.
Compensation: Nobody paid for this page. No affiliate links on this page.
Sources: Each company's own SEC filings, linked next to each number.
Last updated: Nov 10, 2026

General education, the same for every reader. Not a recommendation to buy, sell or hold any security, and it doesn't consider your situation.

More in Learn and Tools · Methodology & Disclosures explains where every number comes from.