To effectively underscore the severity and impact of the audit findings to the business, the internal audit department grades/rates each audit finding to in terms of the impact/severity taking into cognizance the rating of the risk that resulted to the control weakness. The department is also at liberty to adopt other forms of risk classification to effectively communicate the impact of noted control weakness or failures. The following classification method could be adopted.
There are several models or methodologies that can be adopted in determining the audit rating or opinion of conformance of an audit area. Some school of thoughts or models believe that each audit exception or non-conformity should be assigned a weighted score (or %) based on their severity. For instance, 5% for critical severity, 4% for high severity, 3 for medium severity, 2 for low severity, 1 for very low severity and 0 for effective control. The applicable score for each exception or non-conformity are deducted from a maximum score of 100 while the remain score after all deduction forms the final audit rating, which is usually banded for example, above 70% is low risk (Good rating), 30 to 60% is medium risk (opportunity for improvement or average rating) and below 30% is high risk (poor rating).
The best practice for audit rating requires that the various risk identified in each audit area be rated rather than rating the controls/exceptions. The weighted score of each of the risk associated with a given audit area determines the audit rating of process. Where the control(s) implemented to mitigate each risk is either adequate or inadequate, the audit team apportions a weighted score based on their opinion of control adequacy. Rating guide that could be adopted are:
The cumulative weighted score of each of the risk areas forms the audit rating for the client.