The management letter is on the table. The board has asked for a remediation plan, and there’s a date attached to it. Somewhere in the room, someone is already talking about tightening a policy or adding a review step, like the finding is a paperwork problem.
Here’s the thing nobody says out loud in that meeting: a material weakness is usually about your finance team’s capacity and depth, not a missing document. The remediation plan the board wants usually comes down to who is doing the work, and whether they’ve done it before.
That’s not true of every finding. Some are structural, and some are systems problems no hire will fix. Here’s a quick test to sort which kind you actually have, and for the ones that are staffing findings, what to look for in the person you hire.
What the evidence says about causes
The most common driver of a material weakness is people, not policy. In KPMG’s 2024 analysis of SEC filings, material weaknesses attributed to a lack of accounting resources or expertise rose from 34% in 2021 to 60% in 2024, which made it one of the fastest-growing causes over that period. KPMG ties this to a worsening shortage of qualified accountants and high turnover, leaving teams without the people to run the controls their business needs.
Audit Analytics found the same pattern from the other direction. In its review of internal control weaknesses following an IPO, roughly three-quarters of first management reports disclosing ineffective controls flagged an issue with accounting personnel resources, and over half flagged segregation of duties. Even among newly public companies, the staffing gap shows up more often than the control-design gap.
Now, prevalence. Two credible sources report different numbers because they’re counting different populations. It matters that you don’t blend them. KPMG found that 279 of 3,502 companies (8%) filing annual reports in FY2024 disclosed a material weakness, an increase over the prior year. Baker Tilly, analyzing SEC EDGAR data, found that just over 15% of filers reported adverse assessments in 2024, down from over 26% at the 2021 peak. Both are right. KPMG counts all annual filers; Baker Tilly’s base includes management-only and auditor assessments across a different population. The numbers differ because the populations differ, not because one source is wrong.
If your finding traces back to team depth, your remediation plan is partly a hiring plan. But only partly, which is where the diagnostic comes in.
Three kinds of finding, three different responses
Every finding falls into one of three categories: a capability gap, a capacity gap, or a structural gap. The remediation plan is completely different for each.
- A capability finding means your team doesn’t have the technical depth for the judgments the business requires. Complex revenue recognition, a first-time consolidation, a tax provision nobody on staff has built before. The work is beyond the current team’s experience. This is a hiring problem.
- A capacity finding means the team understands the work but can’t get it done in time. The close runs long, reconciliations pile up, reviews get skipped because there aren’t enough hours. This might be a hiring problem, or it might be a process one. Sometimes you need another set of hands. Sometimes you need to stop doing the close in a way that guarantees you’ll run out of time.
- A structural finding means the math of a small team makes proper segregation of duties impossible. In a four-person finance function, the same person may be recording and reconciling because there’s no one else. You can’t fully hire this away. It needs compensating controls: documented management review, approval thresholds, and clear evidence that someone independent is checking the work.
The quick test: ask whether the person doing the task could do it correctly given more time or more training. If yes, it’s capacity or capability, and a hire may solve it. If the problem is that too few people are splitting duties that should be separated, it’s structural, and you’re building controls, not just a job posting.
Most of the findings that send employers looking for a new controller are capability findings.
What a controller who has done this before looks like
The person you want has remediated a finding before and lived through the next year’s audit to see whether it held. That’s a narrow skill, and it’s easier to screen for than most finance hires.
Someone who has done this knows what an auditor will actually accept as evidence and what gets waved through. They know the difference between a control that looks good on paper and one that produces a documentation trail an auditor can test. They’ve written a remediation plan, run it, and had it survive scrutiny the following year. A first-time controller can learn all of this, but learning it on your deadline is a gamble.
Four questions tell you whether someone has genuinely done the work:
- Walk me through a finding you remediated and how long it took. You’re listening for a real timeline with specifics, not a textbook description of the remediation process.
- What documentation did the auditor accept, and what did they push back on? Someone who’s been through it remembers the friction. The answer is concrete, because they lived it.
- What did you change permanently versus what you did just to get through the audit? This separates people who fixed the control environment from people who staged a clean-up for one cycle.
- What would you do differently next time? A real practitioner has a regret or two. A candidate who says it went perfectly probably hasn’t done it.
Here’s what makes this hire unusual: these are checkable claims. A remediation tied to a specific fiscal year and a specific auditor is something a reference can confirm. You can ask the former manager whether the finding was cleared and whether it stayed cleared. Very few finance hires let you reference-check against a single, verifiable event this cleanly.
Hiring under a deadline without making it worse
A permanent controller search runs about ten to twelve weeks from kickoff to signed offer, and your board deadline is often shorter than that. The market isn’t helping either. In a 2025 survey of more than 1,500 Canadian hiring managers, 94% said hiring now takes longer than it did two years ago. So you have a gap between when the work must start and when the right permanent hire can realistically be in the chair.
You have three honest options, and they aren’t mutually exclusive.
Bring in contract or consulting support for the documentation work. An experienced interim resource can build the remediation evidence and control documentation while you run the permanent search properly. This buys you time without forcing a rushed permanent decision.
Run remediation in parallel with the search. The interim resource starts the fix; the permanent controller inherits a plan already in motion and owns it going forward.
Negotiate the timeline. This is more often possible than employers assume. Auditors and lenders generally respond well to a credible, specific remediation plan with a named owner and real dates. A believable plan can earn you more room than a panicked hire ever will.
One warning. Hiring in a panic is exactly how a mis-scoped role happens. You post for the person who can start Monday instead of the person who can actually do the work, and you find out later it was the wrong call. In the same survey of 1,500-plus Canadian hiring managers, 24% admitted to a hiring mistake in the past two years; it took four weeks on average to recognize it, and teams lost more than 15 hours of productivity a week dealing with the underperformance. A bad hire under a deadline doesn’t fix the finding. It gives you two problems instead of one.
What you’re actually buying beyond the fix
A controller hired to remediate a finding usually doesn’t leave once it’s cleared. They stay and run the function. So screen for the permanent job as well as the immediate one, because you’re making a multi-year decision under short-term pressure.
That means the interview questions above are necessary but not enough on their own. The remediation experience tells you they can clear the finding. The rest of your interview should tell you whether this is someone you want owning your close, your reporting, and your relationship with the auditor for the next several years.
There’s reason to think remediation works when it’s resourced properly. In KPMG’s FY2024 analysis, segregation-of-duties themes rose about 4% year over year while material weaknesses tied to restatements fell 7%. Read together, that suggests companies are catching and fixing control problems before they turn into restatements, which is exactly what good remediation should do. It comes down to putting the right person on it.
One note on scope: if your finding is rooted in a systems change, a migration or implementation that broke your control environment, that’s a related but different hire. And if the remediation exposes a broader gap in your finance function, it may be worth stepping back to think about the order you build the team before filling any single seat.
The plan the board wants to see
When you walk back into that room, the board is looking for three things, in this order.
The diagnosis: which of the three findings you have, and the evidence behind that call. The response: the hire, the contract support, or both, matched to the finding. And the timeline: real dates with a named owner attached to each milestone, so there’s a person accountable, not just a plan.
Get those three right and the deadline stops feeling like a threat. It becomes a schedule you’re managing on purpose. That’s the difference between hiring in a panic and hiring well: a credible plan buys you room, and room is what lets you make the right call instead of the fast one.
If you’d rather not run the search alone, our team recruits accounting and finance talent across Toronto and Ontario, including controllers who’ve remediated findings before and can prove it. Tell us what the letter says, and we’ll give you a straight read on what the search actually looks like.
FAQs
Is a material weakness always a hiring problem?
No. It’s most often a capability finding, where the team lacks the technical depth for the work, and that’s a hiring problem. But a capacity finding may be solved by process changes rather than headcount, and a structural finding, like segregation of duties in a four-person team, can’t be fully hired away and needs compensating controls instead. Diagnose which one you have before you post a role.
How long does it take to hire a controller to remediate a finding?
A permanent controller search typically runs about ten to twelve weeks from kickoff to a signed offer, which is often longer than a board deadline allows. Many employers bridge the gap with interim or consulting support for the documentation work while running the permanent search in parallel, so remediation starts immediately without forcing a rushed permanent hire.
What interview questions identify a controller who has remediated a finding before?
Ask them to walk you through a specific finding they remediated and how long it took, what documentation the auditor accepted or pushed back on, what they changed permanently versus just for the audit, and what they’d do differently. These answers are concrete when the experience is real, and because they tie to a specific fiscal year and auditor, a reference can confirm the finding was actually cleared and stayed cleared.
Can we negotiate the remediation deadline with our auditor or lender?
Often, yes, and more often than employers assume. Auditors and lenders generally respond well to a credible, specific remediation plan with real dates and a named owner. Presenting a believable plan tends to earn more room than a rushed, mis-scoped hire, which can add a second problem on top of the original finding.
