When an auditor identifies a control deficiency on a public company audit, the auditor should assess the severity of the control deficiency. What are the two factors that the severity of a control deficiency relies upon? Please elaborate on the criteria surrounding each of these factors.