Audit Report Ratings

An audit report rating is typically assigned to the overall opinion, reflecting whether that control environment is adequately reducing the risk to the organization. The audit report rating is typically found on the same page or header as the executive summary. There is no one standard format for an audit report rating used. Like the report format itself, the rating scale will depend on the organization and industry norms.

Regardless of the rating scale used, the audit rating will reflect the overall opinion on the health of the controls being assessed. The rating scale is simplified to provide management a quick snapshot of the audit’s overall opinion. An example of the rating scale for an audit report is as follows:

• Satisfactory—The control environment is substantially compliant with policies and industry norms.

• Needs improvement—The control environment is partially compliant with policies and has pockets of noncompliance that need to be remediated.

• Ineffective—The control environment is substantially noncompliant with policies and industry norms and requires urgent remediation to become compliant with policies.

Notice in our example that these audit report ratings are on the overall health of the control environment. The rating does not reflect a specific control but should be a holistic opinion on the collection of controls. This is where art versus science comes in determining the overall health of a control environment. To illustrate, let’s consider a situation where 9 out of 10 controls passed the audit examination and were found to be compliant. Is passing 90% of the time satisfactory, needs improvement, or ineffective? Depends on the impact on the organization. For example, let’s assume a piece of factory machinery must be checked for safety before every shift and the supervisor initials the check. There is a substantial difference between the supervisor forgetting to initial and forgetting to perform the safety check.