the severity of the deficiency would likely represent a material weakness or significant deficiency if a. the risk factors considered as a part of the evaluation indicated a lesser IT risk b. the deficiency affected multiple applications and accounts and there is insufficient evidence that management's controls would have timely detected a material misstatement c. the deficiency affected GITCs d. there is sufficient compelling evidence to conclude that management's controls would have timely detected a material misstatement