Internal Audit Report Rating

To effectively underscore the severity and impact of the audit findings to the business, the internal audit department grades/rates each audit finding to in terms of the impact/severity taking into cognizance the rating of the risk that resulted to the control weakness. The department is also at liberty to adopt other forms of risk classification to effectively communicate the impact of noted control weakness or failures. The following classification method could be adopted.

  • Major non-conformity: This pertains to a major deficiency in the control environment or management system.
  • Minor non-conformity – A minor deficiency meaning that one or more elements of the control or management system is/are only partially complied with.
  • Observation - An area of worry, a process, document or activity of concern, which if not enhanced, result in a non-conforming system, product or service. Observation shows potential risk of non-conformity.
  • Opportunity for Improvement– A hint for improvement which may or may not be implemented by the auditee.
  • Positive findings (Conformity)– Findings that pertains to processes and/or systems that go beyond what is being required of the standard.

There are several models or methodologies that can be adopted in determining the audit rating or opinion of conformance of an audit area. Some school of thoughts or models believe that each audit exception or non-conformity should be assigned a weighted score (or %) based on their severity. For instance, 5% for critical severity, 4% for high severity, 3 for medium severity, 2 for low severity, 1 for very low severity and 0 for effective control. The applicable score for each exception or non-conformity are deducted from a maximum score of 100 while the remain score after all deduction forms the final audit rating, which is usually banded for example, above 70% is low risk (Good rating), 30 to 60% is medium risk (opportunity for improvement or average rating) and below 30% is high risk (poor rating).


The best practice for audit rating requires that the various risk identified in each audit area be rated rather than rating the controls/exceptions. The weighted score of each of the risk associated with a given audit area determines the audit rating of process. Where the control(s) implemented to mitigate each risk is either adequate or inadequate, the audit team apportions a weighted score based on their opinion of control adequacy. Rating guide that could be adopted are:

  • Critical risk (very poor rating; 0 -20%).
  • High risk (poor rating; 20-30%).
  • Medium risk (average rating; 30-50%).
  • Low risk (good rating; 50-70%).
  • Very low risk (very good rating; 70-90%).
  • Insignificant risk (outstanding (90-100%).


The cumulative weighted score of each of the risk areas forms the audit rating for the client.


To get our IT audit programs/checklists, Click here

To get our risk assessment templates, Click here



Back To Internal Audit Leading Practices

Let us know your thoughts post. Leave a Comment below.