Material Weakness Tracker: Q3 2026

How it is made

The tracker combines three things. Judgment: practitioners decided what to track (which companies report material weaknesses, what the weaknesses are about, which kinds of filer report them and whether they are new) and what a reader needs to see first. Expertise: the definitions come from SEC and PCAOB requirements, and the 16 cause categories and the counting rules are built from audit practice; all of them are set out on this page. Frontier AI: after an automated screen set aside 418 of the 1,793 candidate filings, AI models read the controls disclosure of each of the other 1,375 against those rules, and their work was checked in six ways, described below. Every row links to its filing, so any reading can be checked.

What is in scope

Every 10-K and 10-Q (including amendments and transition reports) filed on SEC EDGAR between July 1 and September 30, 2026, in which the company reports a material weakness in internal control over financial reporting, concludes that its disclosure controls or internal control were not effective, or reports that an earlier material weakness has been remediated; plus every 8-K filed in the same window under Item 4.02, non-reliance on previously issued financial statements. “Q3 2026” refers to the filing date, not the fiscal period: a June-quarter 10-Q filed in August is in this edition, and a September-quarter 10-Q filed in November is not. Foreign private issuers that report on Form 20-F or 40-F are not included.

How the filings were found

We searched the full text of EDGAR filings made in the window for “material weakness”, “material weaknesses” and the usual wordings of a not-effective conclusion (“controls and procedures were not effective”, “control over financial reporting was not effective” and their variants), and for 8-Ks carrying Item 4.02. Only the main 10-K or 10-Q document counts: the CEO and CFO certifications attached to every periodic report mention material weaknesses as a matter of form and were excluded. That produced 1,793 candidate filings from 1,611 companies.

How each filing was read

For each candidate we extracted the controls disclosure: Item 4 of a 10-Q, Item 9A and management’s report on internal control of a 10-K, Item 4.02 of an 8-K. An automated screen then set aside 418 filings whose controls section stated an effective conclusion and never mentioned a material weakness; they had matched the search only because the term appears elsewhere, for example in risk factors. The other 1,375 were classified one by one against a written rubric: whether a material weakness existed at the end of the period, the disclosure-controls and internal control over financial reporting (ICFR) conclusions, whether the weakness was newly disclosed or previously reported, how many weaknesses the company counted, what each was about (16 cause categories), and a one-line summary of what was disclosed. When a 10-Q only refers back to the weaknesses described in the annual report, the causes are taken from the remediation steps it describes if those name specific control areas, and are otherwise recorded as “Other or not described”. Of these, 112 (including four removed in the final review described below) turned out to report no current weakness, ineffective conclusion or remediation in the period and are not in the dataset; the other 1,263 are.

The reading was done by frontier AI models, working from the extracted text and the rubric, and then checked in six ways. A second AI reader, run separately, re-classified a random sample of 60 filings without seeing the first answers: it assigned the same status to 58 of them (97%), and for the 44 filings both read as a material weakness, the cause categories overlapped in 42 (95%) and were identical in 39 (89%). Automated consistency checks compared every classification with the wording of its controls section and flagged mismatches, such as a material-weakness status where the section never names one; every flagged filing was re-read by AI. Every filing the first reading could not classify, and every row whose summary was incomplete, was re-read by AI against the full filing (97 filings). Between them, these checks sent 163 filings for a second AI reading, which led to 26 status corrections and about 60 completed or corrected descriptions. Before publication, separate AI review passes re-read 285 filings against text freshly extracted from them: every large accelerated and accelerated filer, every remediation and every non-reliance notice, plus a random sample of the rest. They confirmed the status of 281; the other four were remediations already reported in an earlier filing, and they were removed. The review corrected causes, weakness counts or controls conclusions on 57 rows, and every reviewed row’s description was rewritten in plain English. Then the tagged cover-page data of every filing in the dataset was read again: company names now appear as filed (19 companies have changed their names since), the exchange is the one the company was listed on when it filed (9 have since left Nasdaq or the NYSE), and filer flags were corrected on 24 filings. A check of every disclosure-controls conclusion against the filing text completed or corrected 48 of them.

Company details

Company names, filer status (large accelerated, accelerated or non-accelerated) and the smaller reporting company and emerging growth company flags are taken from the cover page of each filing, as tagged by the company, so they show the company as it was when it filed. Tickers and exchange come from the same cover when it lists securities registered on an exchange; otherwise, as for most companies quoted over the counter, they come from EDGAR’s company record. The industry comes from the SIC code on EDGAR, grouped into 23 industry groups for the charts. For 10-Ks, the auditor is the one named in the filing.

Definitions

• Material weakness: the filing says one or more material weaknesses existed at the end of the period it covers, whether newly identified or still being remediated.
• Not effective, no weakness named: management concluded its disclosure controls (or ICFR) were not effective but did not identify a material weakness. These filings are listed but are not counted as material weaknesses.
• Remediated: the filing says a previously reported material weakness was remediated in the period it covers and none remains. A remediation already reported in an earlier filing and merely repeated does not count.
• Non-reliance notice (8-K 4.02): in an 8-K under Item 4.02, the company told investors that previously issued financial statements should no longer be relied on because of an error in them.
• Newly disclosed means the filing says the weakness was identified in the period it covers or while preparing the report, or the company’s previous 10-K or 10-Q never mentioned a material weakness. Previously reported means the filing says the weakness was disclosed before or is still being remediated, or the previous 10-K or 10-Q had already reported ineffective controls. If neither settles it, the row is marked timing unclear. A company with an old weakness and a newly identified one counts as newly disclosed. This is the least certain field: in the blind re-read, the second AI reader never contradicted a newly disclosed or previously reported call, but of the 44 filings both readers classed as a material weakness, it marked the timing unclear in 12 where the first reading had rested on the company’s previous filing.

Cause categories

Each material-weakness filing is tagged with one to five of these categories, by what the weakness is about.

• Segregation of duties: incompatible duties held by one person, or too few people to separate them.
• Accounting staff & expertise: too few accounting or finance staff, missing GAAP or SEC reporting expertise or training, reliance on one person, or turnover in finance.
• Control environment & oversight: weaknesses in entity-level controls, such as the lack of an independent audit committee or board oversight, tone at the top, risk assessment (including fraud risk), monitoring, and information and communication.
• Financial close & reporting: account reconciliations, journal entries, period-end cutoff, preparing the financial statements, consolidation, disclosure review and filing on time.
• Review controls & evidence: management review controls that are not precise enough, or too little evidence that controls were performed and reviewed.
• Complex or non-routine accounting: business combinations, impairment, debt and equity instruments, convertibles and warrants, derivatives, stock compensation, leases, consolidation and variable interest entities, fair value, digital assets and discontinued operations.
• IT general controls: user and privileged access, program change management, IT operations, system and ERP implementations, cybersecurity controls relevant to financial reporting, and the reliability of system-generated reports.
• Written policies & procedures: no formal, documented policies and procedures.
• Restatement or error correction: the weakness is tied to a restatement or correction of errors in previously issued financial statements.
• Revenue: revenue recognition, receivables, contract assets and deferred revenue.
• Third parties & service organizations: service organizations and their SOC 1 reports, outsourced accounting, and consultants’ work that was not reviewed.
• Cash & disbursements: cash and treasury, disbursements and payment approvals, bank reconciliations, wires and payroll payments.
• Related parties: identifying, approving and disclosing related-party transactions.
• Income taxes: the income tax provision, deferred taxes and uncertain tax positions, and indirect taxes when the filing cites them.
• Inventory: inventory existence, valuation and costing, and cost of sales.
• Other or not described: anything else, such as accruals, fixed assets, earnings per share or segment reporting, and weaknesses the filing does not describe.

How the numbers are counted

Headline figures count companies, not filings: a company that filed both a 10-K and a 10-Q in the quarter, or a filing and its amendment, counts once, with the causes from all of its material-weakness filings combined. A company’s status is the most serious one across its filings: material weakness, then ineffective controls, then remediated. A company’s filer status, smaller reporting and emerging growth company flags, industry and exchange are taken from its latest filing in the quarter that reports a weakness (if two were filed on the same day, the one with the later accession number). The 8 companies whose only filing in the dataset is an 8-K non-reliance notice count toward the 8-K figures only. Cause shares are the share of companies with a material weakness that cite each cause; a company can cite several, so the shares add up to more than 100%. “Larger filers” means large accelerated and accelerated filers; “other companies” are all the rest. The counts in the explorer’s filter lists are filings, not companies.

Limitations

• The tracker records what companies say. It does not second-guess management’s conclusion or the auditor’s.
• Many 10-Qs only refer back to the weakness described in the annual report. Those rows say so; their causes come from the remediation steps where those name a control area, and are otherwise shown as “Other or not described”.
• Companies are counted when they file, whatever period the filing covers: 43 of the companies with a material weakness reported it in a late, amended or transition-period filing for a period that ended before 2026.
• Not every restatement comes with an 8-K Item 4.02. Revisions of immaterial errors (“little r” restatements) do not, so the 8-K list understates error corrections; the “Restatement or error correction” cause captures those that a 10-K or 10-Q links to a material weakness.
• Full-text search finds the words companies use. A filing that described a material weakness without using the term or a standard not-effective wording would be missed; we expect very few.

Editions and changelog

Corrections to the data since publication: none.

Most of the weaknesses in this tracker come down to a handful of control families, and the site covers each of them in depth. How a deficiency is judged to be a material weakness in the first place is set out in evaluating control deficiencies. If you own a key control, start with SOX for control owners: what testers ask for, and how an exception becomes a deficiency or a material weakness. The cause small companies cite most is the subject of segregation of duties beyond the ERP, and compensating controls covers what a thin finance team can do instead; the most common cause at larger filers is the subject of the ITGC audit primer.

After the disclosure comes the remediation: evidence standards for issue closure sets out what proof a fix needs, sustainability testing covers keeping it fixed, and testing controls in small populations deals with the quarterly and annual controls that remediation plans so often depend on. For companies new to the public markets, standing up internal audit after an IPO walks through the first 18 months, and our guide to COSO explains the framework nearly all of these assessments are measured against.