Who makes the final determination if a weakness is material or not?

• A. OMB
• B. Management
• C. Internal Audit
• D. SECDEF

Answer: (B)

The final determination of whether a weakness is material is made by management. They own and operate internal controls, gather the evidence, assess risk, and certify the overall control environment in the annual assessment. Internal auditors (and external auditors) identify deficiencies and provide independent input, but the formal classification as a material weakness rests on management’s judgment based on the evidence. Oversight bodies or the department’s top official influence reporting requirements and governance, but they do not make the final determination.