Every audit function rates findings high, medium, or low. Almost none can hand you the calibrated definitions behind those words — which is why rating conversations in most shops are negotiations: the auditee argues the rating instead of the facts, the auditor defends a gut feel dressed as a judgment, and over time the scale drifts wherever the loudest meeting pushed it. The fix is embarrassingly concrete: publish the matrix. Defined impact anchors, defined likelihood anchors, a grid that converts the two into a rating mechanically, worked calibration examples, and governance that makes the rating an output of the framework rather than a term in a settlement.
This page is that matrix — the one almost nobody publishes — with the parts that make it portable: anchors expressed relative to your materiality and risk appetite rather than someone else’s dollar figures, aggregation rules for the five-mediums-equal-a-high problem, and the dispute process that keeps facts negotiable and ratings not. It slots into the findings craft alongside our five C’s guide (which builds the finding this page rates) and maps cleanly to the separate SOX deficiency ladder, covered below.
This guide was rewritten in September 2026 to add what the August version left out: twelve calibration cases from the engagements written up across this site, the rule that derives a report’s overall rating from its findings, a rating memo template, how to run a calibration session, how ratings apply to observations, repeat findings and advisory work, and the links to the guides that build the finding beneath the rating and negotiate it afterward. The two axes, the anchors, the grid, the four calibration examples and the governance rules are unchanged. Standard 14.3 requires findings to be evaluated for significance, and the matrix is the instrument that makes two auditors’ evaluations of the same facts come out the same.
In this guide
- Why ratings fail without anchors
- The two axes, done right — and the SOX-regime distinction
- The matrix: anchors and the 4×4 grid
- Calibration examples at every level
- Twelve calibration cases from the engagements on this site
- Aggregation: when five mediums equal a high
- From finding ratings to the report rating: the derivation rule
- The rating memo
- Calibration sessions: how to run one
- Ratings for observations, repeat findings and advisory work
- Governance: who owns the rating, and how disputes end
- Where to go next
Why ratings fail without anchors
An unanchored rating scale fails in three predictable ways. It becomes negotiable — with no written definition of “high,” the exit meeting relitigates the label instead of the action plan, and every concession recalibrates the scale invisibly for the next report. It drifts — different auditors, different years, different moods produce different ratings for identical fact patterns, which committee members eventually notice, and once they distrust the ratings they re-read every finding from scratch, which defeats the entire purpose of rating. It inflates or deflates under incentive — functions measured on “number of highs” produce fewer of them; auditees whose bonuses key on clean audits pressure every medium toward low. Anchors fix all three at once, because a written definition converts “I think this is high” into “this meets the Severe-impact anchor and the Likely threshold — here’s the math.” The rating conversation gets shorter, the disputes move to where they belong (the facts and the anchors themselves), and consistency becomes testable — your QA process can sample ratings against the matrix the same way you sample any control.
The two axes, done right — and the SOX-regime distinction
Impact is multi-dimensional, and the rating takes the worst dimension. A finding’s potential consequence rarely lives on one axis: rate financial exposure, operational disruption, compliance and legal consequence, and reputational damage separately against the anchors, then let the highest dimension set the impact level. This is what stops the classic under-rating of non-financial findings — the safety issue with trivial dollars, the licensing breach with no P&L line. Anchor the financial dimension to your materiality and the others to your risk appetite statements, so the matrix inherits calibration the organization already agreed to instead of inventing a parallel currency.
Likelihood rates the exposure, not the incident. The error found is history; the rating question is forward-looking: given the control condition as it stands, how likely is the consequence to occur (or recur) before remediation? A hole that fires every cycle rates differently from one requiring a rare confluence — even if both were discovered through a single exception. This is the same could-not-did principle that governs SOX deficiency evaluation — and that parallel is worth one clarification your methodology should state explicitly: these are two regimes, not one. The IA severity rating drives management attention, remediation priority, and committee reporting for all findings, on any subject. The SOX ladder (deficiency → significant deficiency → material weakness) is a financial-reporting legal classification with its own definitions. An ICFR-relevant finding gets both labels, assessed independently — a “high” operational finding has no SOX rating at all, and a low-rated ICFR exception can still aggregate into something significant on the SOX side. Programs that blur the regimes end up negotiating material weaknesses in the language of report cosmetics.
The matrix: anchors and the 4×4 grid
Four impact levels, anchored across four dimensions — tune the financial percentages to your materiality and the qualitative anchors to your appetite statements, then stop editing; the value is in the anchors holding still:
| Impact level | Financial | Operational | Compliance / legal | Reputational |
|---|---|---|---|---|
| Severe | Exposure approaching or exceeding materiality | Extended stoppage of a critical process; customer commitments broken at scale | Breach threatening license, registration, or triggering regulator enforcement | Sustained external coverage; loss of key-stakeholder confidence |
| Major | A significant fraction of materiality (calibrate: roughly 20–100%) | Critical-process disruption measured in days; widespread rework | Reportable violation; likely regulator engagement short of enforcement | External visibility probable; board-level embarrassment |
| Moderate | Meaningful but bounded (calibrate: roughly 5–20% of materiality) | Localized disruption; recoverable within the cycle | Policy or contractual exception requiring correction and disclosure to an internal authority | Internal visibility; contained external risk |
| Low | Minimal (under ~5% of materiality) | Inefficiency without disruption | Administrative or documentation exception | Negligible |
Four likelihood levels, rating the condition’s forward exposure:
| Likelihood level | Anchor |
|---|---|
| Almost certain | The condition is systemic — the consequence occurs every cycle it goes unremediated (no control exists, or the control never operates) |
| Likely | Recurring pattern; expect the consequence within the quarter (control operates inconsistently, or is easily bypassed) |
| Possible | Has occurred or plausibly could within the year (control generally operates; specific gap under known circumstances) |
| Unlikely | Requires a rare confluence of failures (defense-in-depth intact around the gap) |
The grid converts the two into the rating — deliberately impact-skewed, because a severe consequence deserves attention even at modest likelihood, while trivia at high frequency is still trivia:
| Impact ↓ / Likelihood → | Almost certain | Likely | Possible | Unlikely |
|---|---|---|---|---|
| Severe | Critical | Critical | High | High |
| Major | Critical | High | High | Medium |
| Moderate | High | Medium | Medium | Low |
| Low | Medium | Low | Low | Low |
Calibration examples at every level
Critical. Users with edit access to the outbound payment file between approval and transmission, no detective control downstream. Impact: Severe — unbounded diversion potential against treasury balances. Likelihood: Likely — the access is live and used weekly for legitimate maintenance, so exploitation requires no new capability. Severe × Likely = Critical, and the rating memo writes itself from the anchors. High. Eleven of forty sampled terminations retained ERP access past the SLA, traced to an unmonitored HR feed failure. Impact: Major — leavers held roles touching payment and master data. Likelihood: Likely — the feed fails recurrently and nothing alerts. Medium. Balance-sheet reconciliations at an immaterial subsidiary completed 30–45 days late for two quarters, reviewed when completed. Impact: Moderate — bounded by the subsidiary’s size. Likelihood: Likely — the backlog is structural. Moderate × Likely = Medium. Low. The travel policy references superseded per-diem rates; expense audits already apply current rates from the system. Impact: Low; Likelihood: Possible; the rating is Low, the fix is an edit, and the report says so without ceremony. Notice what calibration examples do for a function: they are the case law of the matrix — keep the best ones in the methodology, and new auditors rate consistently in their first month.
Twelve calibration cases from the engagements on this site
The four examples above are the matrix’s case law in miniature. The twelve below are the findings from the worked engagements elsewhere on this site, rated through the grid, with the dimension that set the impact and the evidence that set the likelihood. Read them as a calibration set: a new auditor who rates all twelve the way the table does has learned the scale, and a function whose own ratings for similar facts differ from these has found either a difference in its anchors, which is legitimate, or a drift, which is not.
| Finding | Impact: dimension and level | Likelihood and evidence | Grid | Reported as |
|---|---|---|---|---|
| MidState AP: 31 of 46 vendor bank changes unverified, one attempt stopped by the bank (AP audit) | Financial, Major: a diverted payment of up to 212,000 dollars per instance against payments of 1.1 million in a ten-day window | Likely: the control never operates for emailed changes; one attempt in the period | Major × Likely | High |
| MidState payroll: seventeen rate changes entered and approved by one HR administrator (payroll audit) | Financial, Major: unlimited rate changes across 1,400 employees | Almost certain: the workflow permits it every cycle | Major × Almost certain | Critical by the grid; reported as High with the override logged, because the exposure was bounded by the pay-run reconciliation |
| MidState T&E: six approvers at six seconds, 94 percent flag pass-through (T&E audit) | Financial, Moderate: 2.6 million dollars of spend with 30,900 of exceptions found; reputational Moderate for the executive population’s pass-through, internal visibility | Almost certain: the workflow requires nothing of the approver | Moderate × Almost certain | High |
| Brightwater procurement: sole-source program, 57 awards, alternatives found for six of fifteen (procurement audit) | Financial, Major: 2.9 million dollars without demonstrated competition; about 300,000 a year on the re-bid evidence | Likely: the policy sets no standard, so the pattern recurs each quarter | Major × Likely | High |
| Brightwater procurement: seven contracts just under the tender threshold, four for one project (P2P year two) | Financial, Moderate: 380,000 dollars of related scope uncompeted | Likely: displaced circumvention with no ladder monitoring | Moderate × Likely | Medium |
| Brightwater fixed assets: idle bottling line at 1.4 million dollars with no assessment (fixed asset audit) | Financial, Major: an impairment near a quarter of the year’s depreciation charge | Possible: indicators arise a few times a decade; the review process would miss them each time | Major × Possible | High by the grid; reported as Medium with the override logged, because management completed the assessment during fieldwork and the residual was the process |
| Pennine close: 38 unreconciled accounts, 2.1 million pounds gross unexplained, three external auditor points open a year (close audit) | Compliance, Major: a Provision 29 material control that cannot be shown to operate; financial Moderate | Likely: the control operates for most of the 410 accounts and fails for the 38, a pattern that recurred across quarters | Major × Likely | High, with the material-control consequence to the audit committee |
| Pennine close: days to close reported as eight when the logs showed eleven | Reporting, Low: an internal metric defined against the plan rather than the logs, an administrative exception; financial none | Almost certain: every month | Low × Almost certain | Medium by the grid; reported as Low with the override logged, because the correction was a report change made during fieldwork |
| Lakeshore reconciliations: 27 clearing journals, 640,000 dollars, eleven unapproved; eight preparers with posting rights (reconciliation program audit) | Financial, Major: concealment mechanism across 3,100 accounts at a 9-billion-dollar bank | Likely: the pattern recurred across quarters and accounts | Major × Likely | High |
| Lakeshore reconciliations: 22 certifications signed over open exceptions | Reputational and compliance, Moderate: the board and examiners told what the tool contradicts | Likely: the form cannot show the exceptions, and 22 of the year’s certifications were signed over them | Moderate × Likely | Medium |
| MidState order-to-cash: 610 unsupported credit memos, 410,000 dollars, issuer approval (order-to-cash audit) | Financial, Major: the concealment mechanism for diverted receipts across 9,800 accounts; 0.1 percent of revenue realized | Almost certain at the acquired depots: the system routes credits to their issuer | Major × Almost certain | Critical by the grid; reported as High with the override logged, because the condition was confined to the two acquired depots and a referral was already in hand |
| MidState order-to-cash: two unrecognized equipment leases, 140,000 dollars | Financial, Low: below 5 percent of materiality | Possible | Low × Possible | Low |
Four of the twelve carry logged overrides, all downward by one level, and all for the same kind of reason: the grid rated the exposure and the chief audit executive rated the exposure after a bounding fact the grid does not see, a compensating reconciliation, a fix completed during fieldwork, a confinement to one population. That is the override log working as designed; a pattern of overrides in one direction across a year is the signal that the anchors, or the pressure, need attention, and the four here were reviewed at the function’s calibration session and upheld.
Aggregation: when five mediums equal a high
Individual ratings understate connected problems, so the methodology needs written aggregation rules — the same instinct as SOX aggregation, applied to findings. Three triggers: same root cause — five mediums all tracing to the same understaffed close team are one high-rated thematic finding about capacity, with the five as exhibits; same process or objective — several bounded gaps in one revenue stream aggregate on their combined exposure, because the errors they admit can compound; same trajectory — a repeat finding re-rated at the same level despite a prior action plan escalates one level on recurrence, because the aggregate fact is now “the condition plus the failed remediation.” Two mechanics keep aggregation honest: the thematic rating uses the matrix like any other finding — aggregate exposure through the anchors, not vibes — and the engagement-level conclusion (per Domain V’s 14.5) is where the aggregate story lands, so a report of five mediums that reads “generally satisfactory” has failed the aggregation test in public.
From finding ratings to the report rating: the derivation rule
Standard 14.5 requires an engagement conclusion, and functions that rate findings usually rate reports too, on the three-point scale the report template defines: Satisfactory, Needs Improvement, Unsatisfactory. The report rating is derived from the findings under a published rule, and it is not an average, because two real deficiencies inside an otherwise clean process is Needs Improvement, not Satisfactory with observations. The rule below is the one this site’s model methodology uses, and the derivation sentence in the report shows how it was applied.
| Report rating | Derivation | Typical pattern |
|---|---|---|
| Satisfactory | No Critical or High findings; Medium findings contained, with plans; the objective is achieved | Lows and a few Mediums, or a clean report with observations |
| Needs Improvement | One or more High findings whose exposure is limited by a compensating control or was contained during the engagement, or Medium findings that together put the objective at risk; timely management action required | The most common rating on this site’s worked engagements: several Highs with interim measures and confined populations |
| Unsatisfactory | A Critical finding; a High on a key control with no compensating control; a repeat High; or a pattern of Highs across the process that puts the objective at significant risk | The adverse call, made rarely and defended with the derivation sentence |
Two mechanics make the derivation defensible. The derivation sentence names the findings that drove it and the bounding facts that kept it where it is (“the rating reflects three High findings on segregation and verification controls, with interim manual reviews in place from the closing meeting”), so that a summary response disputing the report rating has to dispute a finding’s rating or the rule’s application. And the aggregation rules apply before the derivation: five Mediums with one root cause are re-rated as one High under the aggregation section, and the report rating follows the aggregate, which is how a report of five Mediums avoids reading Satisfactory in public.
The rating memo: the one page that makes a rating defensible
A rating that lives only in the auditor’s head is a rating that gets renegotiated in the exit meeting. The rating memo is the workpaper that fixes it: one page, written when the finding is drafted and before it is discussed with management, that walks the finding through the anchors, the grid, the aggregation check and any override, and names who calibrated it. It is the document the chief audit executive reads before signing the report, the document quality assurance samples against the matrix, and the document the auditor opens when the process owner says the rating is too high. The fields below are the ones that do the work; keep them in this order so that the memo reads as a derivation rather than a defense. The condition line should be the finding’s condition as written for the report, which is why it pays to have it airtight before rating it; the guide to writing conditions covers what airtight means.
Rating memo
Finding reference and title: [engagement code, finding number, short title as it will appear in the report]
Condition in one sentence: [what was found, quantified against the population tested]
Impact by dimension: Financial: [exposure figure, how it was bounded, anchor met]. Operational: [disruption, anchor met]. Compliance and legal: [obligation affected, anchor met]. Reputational: [visibility, anchor met].
Impact level taken: [Severe / Major / Moderate / Low], set by the [dimension] dimension.
Likelihood and evidence: [Almost certain / Likely / Possible / Unlikely], because [the control condition: absent, never operating, inconsistent, bypassable, or generally operating with a specific gap] and [the frequency observed in the period].
Grid result: [Impact] × [Likelihood] = [Critical / High / Medium / Low].
Aggregation considered: [none / shares a root cause with findings x and y / shares a process with findings x and y / repeat of prior finding z], with the effect: [rated separately / rolled into thematic finding / escalated one level on recurrence].
Override: [none / from x to y], reason: [bounding fact the grid does not see, compensating control, fix completed during fieldwork, confinement to a population], approved by [CAE].
Final rating: [rating] — Management position: [agrees / disagrees, disagreement recorded in the report].
Proposed by / calibrated by / approved by / date: [auditor] / [audit manager] / [CAE] / [date].
Filled in for the vendor bank-change finding from the MidState accounts payable audit, the memo reads like this, and notice that every bracket is replaced by a number or a named fact, never by an adjective.
Finding reference and title: AP-FY27-01, Vendor bank account changes processed without independent verification.
Condition in one sentence: 31 of the 46 vendor bank account changes processed in the twelve months to March were made on the strength of an emailed instruction with no call-back to a number held on file, and one fraudulent instruction for $62,000 in the period was stopped by the bank rather than by the company.
Impact by dimension: Financial: payments made within ten days of a bank change totalled about $1.1 million in the period, and the largest single payment in such a window was $212,000; a diverted payment would be a direct loss, recoverable only in part, which meets the Major anchor against materiality. Operational: a diverted payment would trigger a supplier hold and manual re-payment, localized, Moderate. Compliance and legal: none beyond the payment itself, Low. Reputational: a publicized loss to a known scheme would be an internal and board matter rather than a public one, Moderate.
Impact level taken: Major, set by the financial dimension.
Likelihood and evidence: Likely. The verification control does not operate for emailed changes, which are the majority channel, and one real attempt occurred in the period; the anchor for Almost certain was not met because the bank’s own screening has intercepted the only attempt observed, which is a control outside the company’s design but inside its exposure.
Grid result: Major × Likely = High.
Aggregation considered: Shares a root cause (vendor master changes made by the AP team without a second person) with finding AP-FY27-03 on unapproved master data edits; the two are reported separately because their remediation differs, and the thematic point is made in the executive summary rather than by a merged rating.
Override: None.
Final rating: High — Management position: agrees with the rating; disputes the sixty-day remediation date, which is recorded in the action plan.
Proposed by / calibrated by / approved by / date: senior auditor / audit manager / CAE / fieldwork week five.
Two things about that memo are worth copying. The likelihood paragraph explains why the higher anchor was not met, which is the sentence that stops the process owner from arguing the rating up or down on instinct, because the boundary has already been considered. And the aggregation line records a decision not to aggregate, with the reason; an unrecorded non-decision is what lets five separate Mediums slip past the committee as five separate Mediums. The same memo, read six months later by the auditor validating the fix, tells them exactly which facts the rating rested on, so that re-rating after remediation is a matter of checking which of those facts have changed; the life-of-a-finding guide follows that same finding all the way to closure.
Calibration sessions: how to run one
The governance section says to calibrate deliberately. Here is the mechanism, in the form that works for a function of any size from four auditors upward. A calibration session is a ninety-minute meeting, held a few times a year and always after a period with a contested rating, in which the whole function rates the same set of anonymized findings blind and then argues only about the ones where the ratings diverged. It is not a training session and it is not a review of anyone’s work; the findings are stripped of the auditor’s name and the auditee’s name, and the point of the exercise is the scale, not the people.
Preparation is most of the value. The facilitator, usually the audit manager who owns the methodology, picks eight to twelve findings from the last period: two at each level of the grid, at least two whose rating was contested by management, and at least one override. Each finding is reduced to its condition, the figures that bound the exposure and the evidence on the control’s operation, on a single page with the original rating removed. Participants receive the pack two days ahead and return a rating form, with the dimension that set the impact, the likelihood anchor met and the evidence for it, before the session. Ratings submitted after seeing anyone else’s are not counted.
| Segment | Minutes | What happens | Output |
|---|---|---|---|
| Dispersion review | 15 | The facilitator shows the spread of ratings for each finding, without names. Findings where every rating agrees or differs by one level at a boundary are set aside as calibrated. | The short list: findings with a spread of two levels or more, or any split between Critical and High |
| Anchor debates | 45 | Each short-listed finding is discussed in turn. The question is never who was right; it is which anchor the facts meet and whether the anchor’s wording made that clear. Participants who rated differently explain which dimension or evidence drove them. | For each: a re-affirmed rating, or a clarified anchor, or both, recorded as the finding’s rating memo would be |
| Override log review | 15 | Every override since the last session is read aloud with its reason. The group looks for patterns: the same auditee, the same auditor, the same direction, the same reason. | Either no pattern, or a proposed anchor change, or a note to the CAE that the pressure rather than the anchors is producing the overrides |
| Case law and metrics | 15 | The best-argued findings are added to the methodology’s calibration examples. The facilitator records the session’s dispersion score and the QA sample results since the last session. | Updated calibration examples; QAIP metric for the period; the date of the next session |
Two numbers come out of every session and both belong in the quality assurance and improvement program. The dispersion score is the share of findings in the pack on which all participants agreed within one level; a function whose score sits above eighty percent has a scale that means the same thing across teams, and a function whose score drops from one session to the next has either changed its anchors or changed its people. The match rate is the share of ratings sampled by quality assurance between sessions that reproduce through the matrix from the memo’s own facts; below ninety percent, the memos are not carrying the derivation, whatever the ratings themselves look like. Report both to the audit committee once a year alongside the published definitions, because a committee that has seen the function measure its own consistency reads the next report’s ratings without re-deriving them.
The one failure to guard against is the session that becomes a negotiation by other means, where the loudest auditor’s rating becomes the calibrated one. The blind pre-rating prevents most of it, and the rule that the debate is about the anchor’s wording prevents the rest: if a finding splits the room, the outcome is a better anchor, not a majority vote. Sessions that end with the same anchors and no new cases were either given an easy pack or were not honest, and the facilitator should know which.
Ratings for observations, repeat findings and advisory work
Three kinds of item test the edges of the matrix, and each needs a written rule so that the edge does not become a place where ratings quietly disappear.
Observations. Most functions report a class of item below Low: a process improvement, a documentation tidy-up, a suggestion with no control deficiency behind it. Observations are useful, and they are also the most common escape route for a Low or Medium that management would rather not see tracked. The rule that closes the route is definitional: an item is a finding, and is rated, if it meets the Low anchor on any dimension, which in practice means any control that did not operate as designed, any exception against a policy or an obligation, any exposure with a number on it. An observation is what is left, a suggestion where nothing failed, and it goes in its own section of the report, unrated, without a management action plan and without a place in the issue log. The moment an observation acquires an action plan, it was a finding.
Repeat findings. The trajectory rule in the aggregation section is the one that produces the most argument, so state it precisely. A finding is a repeat when the same condition recurs in the same process after a prior action plan was reported closed, or when the prior finding was still open at its due date and the condition is unchanged. A repeat is rated through the grid on its own facts, and then escalated one level, because the aggregate fact now includes a failed remediation; the memo shows both ratings and the reason for the step. The exception is a recurrence with a genuinely new cause, established through the root cause analysis rather than asserted, in which case it is a new finding and the prior one stays closed. The issue log needs a field for this, a link to the prior finding, so that the repeat rate becomes a reportable number rather than an impression.
Advisory work. Advisory engagements produce results that look like findings, and management, having asked for the help, often objects to seeing them rated in the same currency as assurance findings. The engagement terms govern what is communicated and how; the practical convention that keeps the function consistent is to rate the risk the advisory result exposes through the same impact and likelihood anchors, label the output a priority rather than a severity, and carry it in the issue log only when management accepts an action. What the function should not do is let advisory results create a second, softer scale, because within a year the softer scale will be the one management asks for on assurance work too. The same logic applies to findings that management has decided to live with: the rating stands as derived, and the decision is recorded as a risk acceptance, which is a governance act about the response rather than a change to the finding.
| Item type | Rated through the matrix? | Where it appears | Tracked in the issue log? | The rule that prevents drift |
|---|---|---|---|---|
| Finding | Yes, with a rating memo | Body of the report, ordered by rating | Yes, until validated closed | Meets the Low anchor on any dimension |
| Observation | No | Observations section, after the findings | No | Nothing failed; no exposure with a number; no action plan |
| Repeat finding | Yes, then one level up | Body of the report, flagged as a repeat with the prior reference | Yes, linked to the prior issue | Same condition, same process, after a closed or overdue plan; a new cause makes a new finding |
| Advisory result | Risk rated; labelled a priority | Advisory report or memo, per the engagement terms | Only when management accepts an action | Same anchors, different label, no second scale |
| Accepted risk | Yes, unchanged | Body of the report, with the acceptance recorded | Yes, as accepted, with a review date | Acceptance changes the response, never the rating |
Rated findings still have to be written, and a High whose condition is vague or whose consequence is a round number nobody can trace is a High that will be argued back to a Medium in the exit meeting regardless of the grid. The guide to writing consequences is where the impact dimension’s figures come from, and the finding makeovers show five findings rewritten until their ratings carry themselves.
Governance: who owns the rating, and how disputes end
Publish four rules with the matrix. Facts are negotiable; ratings are derived. Management can and should challenge the condition, the exposure math, the likelihood evidence — and when the facts move, the rating moves through the matrix. What nobody negotiates is the grid itself, mid-finding. The rating belongs to internal audit. Auditor proposes, audit management calibrates, the CAE owns the final call — and a management disagreement that survives the facts conversation gets recorded as a disagreement in the report, not resolved by discount. Calibrate deliberately. A periodic session rating anonymized findings across teams, plus QA sampling of ratings against anchors, is what keeps the scale meaning the same thing in March and November — rating consistency is a quality metric your QAIP should carry. Log overrides. When the CAE departs from the grid — legitimate, occasionally — the memo says so and says why; an override log with a pattern is telling you the anchors need recalibrating, or the pressure does. Publish the definitions to the audit committee too: a committee that knows exactly what “high” means reads your reports faster and defends your ratings for you.
Final thoughts
A severity rating is a promise about attention: critical means stop, high means now, medium means this quarter, low means housekeeping. Promises need definitions, definitions need anchors, and anchors need governance, and that is still the whole page in one sentence. What the September additions add is the paperwork that makes the promise auditable: a memo that derives every rating from facts through the grid, a rule that derives the report rating from the findings, a session that measures whether the function’s auditors would rate the same facts the same way, and rules for the three kinds of item that otherwise leak out of the scale. Adopt the matrix, calibrate the percentages once, collect your case law, and watch the exit-meeting arguments migrate from the label to the facts, which is where they were always supposed to be.
Where to go next
The rating sits on top of a finding, so the natural next reads are the guides that build the finding beneath it and the ones that carry it after the report: the five C’s for the structure, the writing guides for each element, the model report examples and the report template set for where the rating and the derivation sentence appear on the page, the negotiation guide for the exit meeting where the rating is tested, and the deficiency evaluation guide for the parallel SOX regime that an ICFR-relevant finding also has to pass through. The Findings & Reporting category holds the rest of the craft, Resources & Templates the shells, and Risk Management & ERM the appetite statements the anchors inherit from.
Related guides
- The 5 C’s of Audit Findings: A Masterclass With Dissected Examples — the structure of the finding the rating sits on, with dissected examples.
- Writing Airtight Audit Conditions — the condition line of the rating memo, written so it cannot be argued.
- Writing Impact That Lands — where the impact dimension’s dollar and risk figures come from.
- Writing Cause Statements That Point to the Fix — the cause that decides whether findings share a root cause for aggregation.
- Finding Makeovers: Five Audit Findings Rewritten — weak findings rewritten until their ratings carry themselves.
- A Library of Model Audit Report Examples (Annotated) — rated findings presented in full reports, with the choices explained.
- Anatomy of an Internal Audit Report — where the rating, the derivation sentence and the ratings table sit on the page.
- The Internal Audit Report Template Set — the report shells whose rating definitions this page’s derivation rule uses.
- Negotiating Audit Findings Without Watering Them Down — scripts for the meeting where the rating is tested against the facts.
- Evaluating Management Responses — when the action plan matches the rating and when it does not.
- Risk Acceptance by Management — the governance act that changes the response to a finding without changing its rating.
- The Life of a Finding — the same MidState finding followed from observation to closure, rating memo included.
- The Finding and Issue Log Template — the fields, including the prior-finding link that makes repeat rates measurable.
- High-Risk vs Low-Risk Audit Issues: Why Tailor Validation — how the rating drives the depth of follow-up.
- Evaluating Control Deficiencies: From Exception to Material Weakness — the parallel SOX ladder for ICFR-relevant findings.
- COSO’s 17 Principles — where evaluated and communicated deficiencies sit in the framework.
- Root Cause Analysis for Audit Findings — the analysis that decides whether a recurrence is a repeat or a new finding.
- Risk Assessment Matrix: Design, Calibration and Pitfalls — design, calibration and the pitfalls.
- MRAs, MRIAs and Consent Orders: Bank Findings Explained — the supervisory findings ladder from MRA to consent order, and audit’s validation role
- The audit escalation ladder — when and how to take a disagreement up a level.
Leave a Reply