An internal audit rating is a one-word conclusion about whether the controls in your area, taken together, manage the risks the audit was scoped to test. It is derived from the individual findings by rules written into the audit function’s methodology, and it is not an average: one High finding on a key control can set the report rating by itself, while four Low findings usually cannot move it at all. The IIA’s Global Internal Audit Standards require a conclusion on every assurance engagement but do not prescribe a scale, which is why one organization reports Satisfactory, Needs Improvement or Unsatisfactory, another reports Effective, Partially Effective or Ineffective, a UK public body reports Substantial, Reasonable, Limited or No Assurance, and a fourth uses five levels or colors. The words travel; the definitions do not, and the definitions are what you are being measured against.
This guide decodes the system from the receiving end: the common scales side by side, how finding ratings roll up into the report rating, who reads each rating level and what it sets in motion, how to argue from your own organization’s definitions, how ratings move over time, and a practitioner’s view of what is worth contesting. It sits between the guide to the worst case, Failed an Internal Audit?, and the auditor-side calibrated severity matrix that explains how individual findings are rated; the Being Audited? hub collects everything else written for people on your side of the table.
In this guide
- What a rating is and where it comes from
- Finding rating versus report rating
- How findings roll up: the aggregation rules
- Who sees what at each rating
- What each rating typically triggers
- How to read your organization’s rating definitions
- How ratings change over time
- Worked example: the Northgate Logistics warehouse audit, two ways
- What is worth contesting, and what is not
- Questions readers ask
- Related guides
What a rating is and where it comes from
Three Standards do most of the work. Standard 14.3 (Evaluation of Findings) requires internal auditors to evaluate the significance of each finding, which in practice is the finding rating. Standard 14.5 (Engagement Conclusions) requires a conclusion on the engagement as a whole, which is where the report rating lives. Standard 15.1 (Final Engagement Communication) requires the final report to carry the results, the conclusions and management’s action plans, to acknowledge actions management has already started or completed, and to reach the people who can act on it. None of the three says what the scale should look like; the guide to Domain V of the Standards covers the engagement requirements in full.
The IIA’s practice guide on the subject, Communicating Results of Internal Audit Services (December 2025), is explicit on that point: a chief audit executive’s methodology may provide a rating scale, though the Standards do not require one; three levels is the most basic form, whether labeled high, medium and low for findings or satisfactory, needs improvement and unsatisfactory for engagements; the terminology must be clearly defined; and the scale should be communicated to management, usually in the final report itself. The same guide suggests that the CAE set a threshold of findings that produces an overall unsatisfactory rating, and observes that agreeing the criteria in advance prevents any appearance that ratings are aimed at particular managers. CIPFA, writing for the UK public sector, states the same fact from the other direction: there is no standard framework for audit opinions and no common definition, which is why it published recommended ones.
The practical consequence is that the same word means different things in different buildings. Needs Improvement at a company that rates on a three-point scale covers everything between clean and failed; the equivalent level on a five-point scale is the exact middle, with two worse levels below it. The table lays the common families side by side, each with a published example so you can read real definitions rather than a textbook version; the “where it is common” column is practitioner observation, the examples are the evidence.
| Scale family | Levels, top to bottom | Where it is common | Published example |
|---|---|---|---|
| Three levels, performance wording | Satisfactory / Needs Improvement / Unsatisfactory | US corporates, banks, universities, school systems | MIT Audit Division; Baltimore County Public Schools |
| Three levels, effectiveness wording | Effective / Partially Effective (or Needs Improvement) / Ineffective | Functions that word the conclusion as control effectiveness, SOX-adjacent teams | The IIA practice guide pairs “satisfactory (or effective)” with “unsatisfactory (or ineffective)” |
| Four levels, split middle | Satisfactory / Partially Satisfactory, some improvement needed / Partially Satisfactory, major improvement needed / Unsatisfactory | UN system and development agencies | UNFPA internal audit reports (engagements initiated from 1 January 2016) |
| Four levels, assurance wording | Substantial / Reasonable / Limited / No Assurance (some add “No Opinion” when the work was insufficient) | UK public sector, where CIPFA recommends these four and councils have adopted them; many other UK and Commonwealth organizations | Chartered IIA assurance definitions |
| Four levels, quality wording | Good / Acceptable / Needs Improvement / Unsatisfactory | Government program and school audits | Victoria (Australia) Department of Education school audit ratings |
| Five levels | Good / Satisfactory / Limited effectiveness / Weak / Unacceptable; other five-point scales add “Strong” at the top or “Critical” at the bottom | UK universities, some large corporates | University of Reading internal audit |
| Color scales | Green / Amber / Red, sometimes Green / Yellow / Amber / Red | Dashboards and committee packs; usually a visual layer on one of the scales above | Practitioner observation; the definitions still live in the written methodology |
| Finding-level only, no overall rating | Each observation rated (for example Material / Significant / Moderate, with minor comments kept out of the report); the report carries no single overall word | Some public university systems and government audit shops | University System of Georgia, Business Procedures Manual 16.4.6 |
Two reading rules apply to every scale. First, the top level means the findings are housekeeping and the objective is met; the middle level or levels mean the objective is at risk but not lost and the fixes are specific; the bottom level means the auditors cannot rely on the control environment to meet the objective. Second, the middle is where the arguments happen, because the boundary between “some weaknesses” and “significant weaknesses” is a written definition applied to facts, and the facts are where you have standing. MIT’s audit division goes as far as publishing a note that a Needs Improvement rating is not a negative result and that management’s action plan matters more than the rating. Few functions say it that plainly, but the logic is the same everywhere: the middle rating is a to-do list, and the committee judges the list.
Labels that look like audit ratings and are not
Managers in regulated or listed companies hear several rating vocabularies in the same quarter, and conflating them causes avoidable alarm. The table separates them.
| Label you may hear | Who issues it | What it rates | Relationship to your audit rating |
|---|---|---|---|
| Control deficiency / significant deficiency / material weakness | Management’s SOX program and the external auditor, under SEC rules and PCAOB AS 2201 | The severity of a deficiency in internal control over financial reporting, judged on magnitude and likelihood of misstatement | A separate ladder with its own tests; a High internal audit finding on a financial-reporting control will be re-evaluated on it, but the two labels do not map one to one |
| MRA, MRIA, consent order | A bank supervisor (OCC, Federal Reserve, FDIC, state regulator) | Supervisory concerns requiring corrective action | Issued by the regulator, not internal audit; audit reports and the issue tracker are among the things examiners read before writing one |
| Priority 1, 2, 3 or “opportunity” | Internal audit on an advisory engagement | The urgency of advice, not the effectiveness of controls | Advisory work carries no assurance rating; the practice guide says advisory reports should avoid implying one, and assurance versus advisory explains the line |
| High-risk entity, inherent or residual risk score | Internal audit’s annual risk assessment | How much attention an area gets in the audit plan | A planning input, not a verdict on your controls; a high-risk area can be audited and rated Satisfactory |
| Self-assessment or RCSA rating | The first or second line (you, or risk and compliance) | Management’s own view of control effectiveness | Internal audit may test it; a gap between your self-assessment and the audit rating is itself a finding in many functions |
Finding rating versus report rating
A finding rating and a report rating are different objects, set by different logic, and most rating disputes go wrong because the manager argues one while the auditors are talking about the other.
A finding rating answers a narrow question: how serious is this one gap? Most functions set it on two axes, the impact if the risk materializes and the likelihood that it will given the control as found, and label the result Critical, High, Medium or Low. The auditor-side guide to finding severity ratings walks through a calibrated impact-and-likelihood matrix with twelve worked cases; the structure of the finding itself, condition, criteria, cause, effect and corrective action, is covered in the 5 C’s of audit findings. The impact axis is usually anchored to money (often as a share of materiality), to operational disruption, to regulatory or legal consequence and to reputation, and the worst dimension sets the level. The likelihood axis is about the control, not about history: a control that does not exist is rated as if the consequence will occur, whether or not it has yet.
A report rating answers a different question: can the organization rely on this area to meet the objective the audit tested? It is a conclusion under Standard 14.5, derived from the findings by a rule, approved by the CAE and carried into the audit committee pack. It is also the word that follows you. Nobody on the audit committee remembers that finding 3 was a Medium; they remember that the Columbus warehouse was Needs Improvement.
| Aspect | Finding rating | Report (overall) rating |
|---|---|---|
| What it rates | One control gap: how bad, how likely | The area against the engagement objective: can it be relied on |
| Typical scale | Critical / High / Medium / Low, or High / Medium / Low | Satisfactory / Needs Improvement / Unsatisfactory, or an equivalent from the table above |
| How it is set | Impact and likelihood against written anchors; aggregation of related findings; a logged override if the grid misses a bounding fact | A derivation rule applied to the finding ratings: floors and caps, not an average |
| Who signs it off | Audit manager, often with a calibration review | The chief audit executive, under Standard 15.1 |
| What moves it | The facts: population, period, exceptions, the existence and operation of compensating controls, whether the gap is design or operation | The highest finding rating, whether it sits on a key control, repeat status, whether Mediums cluster around one cause |
| Where it appears | Next to each finding; in the issue tracker with a due date | On the first page of the report; in the quarterly pack; in next year’s risk assessment |
| What it triggers | Action-plan deadline and validation depth for that finding | Distribution emphasis, follow-up regime, re-audit timing, executive and committee attention |
| What you can argue | Facts, cause, compensating controls, the cell the definitions produce | Only that the rule was misapplied to the finding ratings as they stand |
There is a third level above both. Under Standard 11.3 (Communicating Results) the CAE communicates results to the board and senior management and, where required, draws a conclusion at the business-unit or organization level, built from several reports and often expressed on the same scale. The practice guide shows division-level and enterprise-level conclusions assembled this way, including one that folds in external regulatory findings. If your area is audited in pieces, a run of Needs Improvement reports can produce a division-level conclusion worse than any one of them, because the pattern is itself evidence.
How findings roll up: the aggregation rules
The derivation rule is the sentence in the methodology that turns a list of rated findings into one word. It is worth getting a copy, because it is short, it is written down, and it is the only thing that actually decides the report rating. The practice guide’s own illustration is the clearest statement of the logic: with one high and two medium findings, one would expect an overall conclusion of unsatisfactory or at best needs improvement, and it would be inconsistent, and potentially misleading, to declare the activity satisfactory. The table lists the rules found in most methodologies; the “how common” column is practitioner judgment from reading and writing these documents, not a survey.
| Situation | Typical effect on the report rating | How common | What to check in your methodology |
|---|---|---|---|
| Any Critical finding | Unsatisfactory, regardless of everything else | Near-universal where a Critical level exists | Whether a Critical can be overridden down with CAE approval, and on what facts |
| Any High finding | Caps the report at Needs Improvement; many rules go further and make a High on a key control with no compensating control an Unsatisfactory | Very common | The exact wording: “any High” versus “a High on a key control” versus “a High without mitigation” |
| A High bounded by an effective compensating control, or fixed and operating before the report | Needs Improvement rather than Unsatisfactory; some functions give no credit for fixes made after fieldwork began | Common, with variation | Whether containment during fieldwork counts, and what evidence of the compensating control is required |
| Several Mediums sharing one root cause | Aggregated into a single thematic finding, re-rated on the combined exposure, often to High; the High rules then apply | Common in functions that calibrate seriously | Whether aggregation happens before derivation, and who decides that findings “share a cause” |
| Mediums that together put the objective at risk, no Highs | Needs Improvement | Very common | Whether there is a numeric threshold (for example three or more Mediums) or a judgment test |
| Mediums with credible action plans, objective still achieved | Satisfactory | Common | Whether any Medium at all precludes the top rating; some scales reserve the top level for Low-only reports |
| Lows only | Satisfactory; Lows do not move the report rating | Near-universal | Whether Lows are reported as findings or as unrated observations |
| Repeat finding | Re-rated at least one level higher before derivation; a repeat High usually means Unsatisfactory | Very common in banks and regulated firms; common elsewhere | The definition of “repeat” (same condition, same process, after a closed or overdue plan) and whether a new root cause breaks the chain |
| Issue self-identified by management before the audit, with an owner, plan and date | Reported and labeled; often excluded from the derivation or weighted lighter | Varies widely | Whether self-identified issues count, and what documentation is needed to qualify |
| Scope limitation or insufficient evidence | No rating, a disclaimer or “No Opinion” rather than a bottom rating | Uncommon but provided for | Whether a restricted scope is disclosed in the report and how it reads to the committee |
The number of findings barely matters in that table. What matters is the highest finding rating, whether the worst finding sits on a key control, whether something else bounds the exposure (a compensating control that operated, a fix completed and running before the report, a confined population), whether the finding is a repeat, and whether the Mediums share a cause. Those are the facts to establish during fieldwork, with evidence, before the draft report fixes the narrative. The auditor’s side of these conversations is in negotiating audit findings without watering them down.
Who sees what at each rating
Distribution lists are set by the methodology, not by the rating. Standard 15.1 requires the final communication to be distributed to those who can act on it, which in most organizations means the process owner, the accountable executive, the CEO or CFO on a summary basis, the audit committee through the quarterly pack, and in regulated industries the external auditor and the supervisor on request. What the rating changes is what each of those readers does with it.
The regulatory expectation is explicit for banks. The Federal Reserve’s supplemental policy statement on the internal audit function (SR 13-1) lists, among the information an audit committee should receive, audit results with a focus on areas rated less than satisfactory, and audit issue information including aging, past-due status, root-cause analysis and thematic trends. The OCC’s Comptroller’s Handbook booklet on internal and external audits (version 1.1, July 2019, the edition posted as of November 2026) says an audit report should include an overall assigned audit rating and the root causes of significant weaknesses, and that critical issues should be communicated to the audit committee. The IIA practice guide says the same thing from the profession’s side: boards pay particular attention to engagements rated unsatisfactory and to findings rated high. Outside banking the wiring is looser but the pattern holds, and the quarterly audit committee pack is built around it: reports are ordered by significance, anything below the top rating or carrying a High finding gets its own summary, and overdue and repeat items are tracked by rating.
| Rating | Your executive | CEO / CFO | Audit committee | External auditor | Regulator or examiner |
|---|---|---|---|---|---|
| Satisfactory (top level) | Receives the report; may never mention it | Sees the title and rating on a summary list | Recorded in the pack as a result; a clean report is still a result and is listed | Reads it only if the area is in their financial-reporting scope | Available on request; rarely discussed unless the area is under exam |
| Needs Improvement (middle) | Reviews the draft, approves the management responses, is named as accountable in the pack | Briefed by the CAE if a High finding is involved or the area is sensitive; otherwise sees the summary | A short summary in the results section; tracked quarterly until actions close; questions if actions slip | Reads it if financial-reporting controls are involved; a High finding on such a control gets their own deficiency evaluation | Reads it during the next exam; asks about the status of actions; a less-than-satisfactory rating in an area already under supervisory attention invites questions |
| Unsatisfactory (bottom) | Owns the response personally; often presents the recovery plan upward | Briefed by the CAE before the report is final; may ask for a monthly status | Leads the results section; discussed at the meeting; the executive or manager may be invited; actions reported until validated | Reads it and may change their own testing in the area | Expects to see it and a credible remediation program; may test the same area; examiners weigh overdue actions and repeats heavily |
Two readers deserve a specific note. The external auditor’s interest is governed in the United States by PCAOB AS 2605 (Consideration of the Internal Audit Function), under which the external auditor assesses the competence and objectivity of the internal audit function before deciding whether and how far to use its work; in practice that assessment includes reading its reports in any area that touches financial reporting. A High finding on a financial-reporting control will be run through the external auditor’s own deficiency evaluation, where the vocabulary is control deficiency, significant deficiency and material weakness rather than High or Needs Improvement; evaluating control deficiencies explains that separate ladder. Examiners, for their part, read the report and the issue tracker together, and the OCC booklet reminds them that the overall rating is internal audit’s call and may not match the bank’s own risk view. A Needs Improvement report with every action on time reads differently to a supervisor than a Satisfactory report with an overdue High from two years ago; the supervisor’s own findings are explained in MRAs, MRIAs and consent orders explained.
What each rating typically triggers
The rating is a switch: in most functions it sets the follow-up regime, the reporting cadence, the re-audit timing and the level of attention from above, through written rules that are easy to ask for. The table shows typical settings on a three-level scale; the specifics will differ in your organization, the shape rarely does.
| What is triggered | Satisfactory | Needs Improvement | Unsatisfactory |
|---|---|---|---|
| Management response deadline | Same for all ratings: typically two to three weeks from the draft; some published methodologies set 15 working days from the exit conference | Same | Same, but chased, because the report is wanted for the next committee meeting |
| Action-plan target dates | Lows: often six to twelve months, set by the owner | Mediums: typically three to six months; Highs: typically 90 to 180 days, with interim measures sooner | Highs and Criticals: the shortest credible dates, interim mitigation in weeks, a dated plan for the rest |
| Follow-up and validation depth | Lows often closed on management’s confirmation or a document | Mediums closed on evidence; Highs re-tested after the control has operated | Every finding validated by testing; higher-risk issues closed only after a sustainability period |
| Status reporting | None beyond the issue tracker | Quarterly, by rating, in the committee pack until closed | Monthly to the executive and the audit function in many organizations; quarterly to the committee until validated |
| Re-audit timing | Next cycle per the risk assessment, often two to four years out | The area’s risk score moves up; follow-up on the High findings at their due dates | A follow-up audit commonly within about a year, timed by the CAE on risk |
| Audit committee attention | Listed | Summarized; questions if actions slip | Discussed; the executive may be asked to attend and explain cause and plan |
| Executive attention | Informational | The executive sponsor signs the action plans and is named in the pack | CEO and CFO briefed before issue; the executive owns the recovery program |
| Performance and pay (practitioner observation; the terms are your employer’s, not internal audit’s) | Usually none | In many organizations, ratings and overdue actions feed management scorecards; in others, nothing formal | In financial services especially, a bottom rating and overdue Highs are often visible in scorecards and can affect variable pay |
| Next audit plan | Area may drop in priority | Area stays or rises; related areas may be added | Area flagged; adjacent processes covered; the cause may be tested elsewhere |
Three rows deserve expansion. On follow-up, SR 13-1 says that for higher-risk issues internal audit should perform and document substantive testing before closing them, and that action plans should be closed only after a period of sustainability; that is why a High finding is not closed on a memo, why sustainability testing exists, and why issue validation is a testing exercise rather than a reading one. On response deadlines, the published methodologies cited here set short, firm dates: the University System of Georgia requires written corrective action plans within 15 working days of the exit conference and follows every material issue until it is closed; the University of Reading expects its highest-grade recommendations to be actioned within three months and reports anything still outstanding to its audit committee. On re-audit timing, the area’s position in the next annual risk assessment decides it, and a bottom rating pushes that position up; how audit plans choose what gets audited explains the mechanics.
The row about performance and pay needs care. In many organizations, particularly in financial services, audit ratings and overdue audit actions appear in management scorecards and can affect variable compensation; in many others they do not appear anywhere formal, and the only consequence is the conversation your executive has with you. That is practitioner observation, not a rule, and no survey figure exists to put behind it. The terms are set by your employer, not by internal audit, and internal audit does not usually know what they are.
How to read your organization’s rating definitions
Everything above describes common practice. Your rating was produced by one specific document: the rating methodology your audit function uses, which the practice guide says belongs in the internal audit manual, should be communicated to management, and is usually reproduced as an appendix or back page of the report. Many functions also publish it on the intranet. If you cannot find it, ask the audit lead at the opening meeting; the request is routine and signals that you intend to engage on the merits.
Reading the methodology is a one-hour exercise if you do it with a purpose. The worksheet below is the version used with managers who are about to receive a draft; fill it in before the closing meeting, not after the report is final.
| Step | Question to answer | Where to look | What to write down |
|---|---|---|---|
| 1 | What are the finding levels and the report levels, in the function’s exact words? | Report appendix or back page; audit manual; intranet | Both scales, verbatim, with the definition of each level |
| 2 | What is the derivation rule? | The paragraph that starts “the overall rating is determined by” or similar | The floors and caps: what a Critical does, what a High does, what a cluster of Mediums does |
| 3 | How is impact anchored? | The impact table: financial thresholds (often tied to materiality), operational, regulatory, reputational definitions | The dollar bands and the qualitative anchors that apply to your findings |
| 4 | How is likelihood anchored? | The likelihood table: definitions of almost certain, likely, possible, unlikely (or similar) | Whether likelihood is about the control condition or about history; most methodologies say the control |
| 5 | What counts as a compensating control, and what evidence is required? | Override or mitigation section; sometimes a footnote | The test the second control must pass: operated during the period, evidenced, independent of the failed control |
| 6 | Does fixing it during fieldwork change the rating? | Containment or “remediated during the audit” language | Whether credit is given, and the cut-off date for it |
| 7 | How are repeat and self-identified findings treated? | Definitions section | The repeat escalation rule and the self-identification conditions, exactly |
| 8 | What does each rating trigger? | Reporting and follow-up sections; distribution matrix | Who receives what, validation depth by rating, re-audit expectations |
| 9 | Where do my findings land when I apply the definitions myself? | Your own evidence, against steps 2 to 7 | Your proposed cell for each finding, with the evidence that puts it there, before the closing meeting |
Definitions also use a small vocabulary that carries more weight than it appears to. The next table lists the phrases that decide ratings, what each commits the auditors to, and the question that tests whether the phrase was earned.
| Phrase in the definitions or the draft | What it commits the auditors to | What you can ask |
|---|---|---|
| “Key control” | That this control is one of the few on which the objective depends, usually identified in the planning memo or the risk and control matrix | Where was it designated key, and are the other controls over the same risk in the matrix? |
| “Compensating control” | That a second control would catch or prevent the same failure; if they credit it, the rating usually drops a level | What evidence of its operation did you review, and for which months? |
| “Pervasive” or “systemic” | That the failure runs across locations, periods or transaction types, not a pocket | How many of the sampled items, sites or months showed it, and how was the sample chosen? |
| “Isolated” | That the exception does not indicate a design gap; usually a lower rating | Nothing, except to make sure the word survives into the final report |
| “Could result in” versus “has resulted in” | The first is a forward-looking risk statement; the second claims an actual loss or breach and must be evidenced | If “has resulted in”: what is the loss, error or breach, and where is it documented? |
| “Repeat” | That the same condition was reported before in the same process and the action was closed or overdue; escalates the rating | Which prior report and finding, and was the prior cause the same as this one? |
| “Management was aware” | That the gap was known and not acted on; read by the committee as a conduct point, not a control point | Aware of what, when, and from which document? If you escalated it and were refused, that belongs in the cause |
| “Partially effective” | The middle level: the control exists and works some of the time or for some of the population | What share of the population or period did it cover, and is that share in the definition? |
| “Cannot rely” or “no assurance” | The bottom level: the auditors are telling the board the area does not meet its objective | Which rule in the derivation produced this, and from which finding? |
| “Objective at risk” | The hinge between the top and middle levels; a judgment that must be tied to specific findings | Which findings, and in what combination, put the objective at risk? |
The argument that works always has the same shape: here is your definition, here are the facts as evidenced, and the definition applied to the facts gives a different cell. The guide to disputing an internal audit finding covers how to raise it and in which window; the short version is that facts are challenged during fieldwork, ratings at the preliminary-findings stage or the closing meeting, and the draft report is late for both; what can still change once the draft lands is in reviewing the draft audit report in 48 hours. Standard 13.1 (Engagement Communication) requires the function to have a methodology that lets both sides state their positions and obliges auditors to seek mutual understanding, but it also means they need a valid reason to change a result. A valid reason is a fact plus a definition. It is never a preference.
How ratings change over time
A rating is dated the day the report is issued, but it does not expire. It lives on in three places: the issue tracker, where each finding carries its rating and its due date; the audit committee pack, where open and overdue issues are reported by rating every quarter; and the audit function’s risk assessment, where the last report rating is one of the inputs to when you are audited next. The guide to audit issue tracking shows the data model behind that, and the life of a finding follows a single issue from fieldwork observation to closure.
Ratings also escalate. The two common escalators are repeat findings and overdue actions. A repeat finding is the same condition found again in the same process after a closed or overdue action plan, and most methodologies re-rate it at least one level higher than its facts alone would justify, on the reasoning that management knew and did not act. The OCC booklet says that multiple changes to an issue’s owner or target date, and repeat audit issues, should trigger additional root-cause analysis of management’s ability and willingness to correct deficiencies, which is regulator language for the same idea. Overdue actions climb a ladder of their own. Standard 15.2 (Confirming the Implementation of Recommendations or Action Plans) requires the function to confirm that actions were implemented or that management has accepted the risk of not acting, and Standard 11.5 (Communicating the Acceptance of Risks) requires the CAE to escalate to senior management and, if unresolved, the board when management accepts a risk beyond the organization’s tolerance. A silently missed date is read as risk acceptance without the paperwork, and the escalation ladder describes how that climbs from the audit lead to the committee.
| Event | Typical effect on the finding | Typical effect on the area and the next report | Who hears about it |
|---|---|---|---|
| Action completed and validated on time | Closed; rating retired | Risk score eases; counts toward a clean follow-up | Issue tracker; a closure line in the pack |
| First extension requested before the due date, with evidence of progress and interim mitigation | Date moved; the extension is logged against the finding | Neutral if rare; extensions are a committee metric | Audit manager or CAE approves; appears in the pack as an extended item |
| Second or later extension | Logged; approval usually moves above the owner; the finding is flagged as serially extended | Read as a capacity or commitment problem; invites a thematic question | CAE; the owner’s executive; the committee sees the count |
| Action overdue with no request | Reported as overdue, by rating, with the owner’s name | An overdue High is the single most visible item in a pack; the area’s risk score rises | Executive and committee; in banks, examiners read the aging report |
| Validation fails (the fix does not operate or does not address the cause) | Reopened; new date; sometimes re-rated | Reported as a failed validation; credibility cost for the next closure request | Executive; the committee in the closures line |
| Same condition found again at the next audit | Rated on its facts, then escalated at least one level as a repeat | A repeat High usually makes the report Unsatisfactory on its own | Everyone who sees the report; repeats are tracked as a function-level metric |
| Repeat of a repeat | Escalated again; the cause moves from control design to management accountability | Likely Unsatisfactory; the function may test the same cause in adjacent areas | CEO or CFO and committee; in regulated firms, expect a supervisory question |
| Risk formally accepted by someone with authority, documented | Rating retained; status changes to accepted; escalated under Standard 11.5 if beyond tolerance | Reported as an acceptance; the committee notes it | Senior management and, if unresolved, the board |
| Quiet non-action (the date passes, nobody asks) | Treated as overdue, then as de facto risk acceptance without authority | The worst version of every row above, with the owner’s name attached | Escalated up the ladder until someone with authority decides |
The ladder has a benign direction too. Actions validated on time, interim measures with evidence, and a clean follow-up audit lower the area’s risk score and lengthen the gap before the next engagement; the guide to living with internal audit year-round covers how to build that record between audits. When an action will not be done, the correct exit is formal risk acceptance by management with the right signature, which keeps the finding’s rating but changes its status and ends the overdue clock; the incorrect exit is letting the date pass. Where the line between tolerable and intolerable risk sits is a governance question, and risk appetite versus tolerance explains the vocabulary.
Worked example: the Northgate Logistics warehouse audit, two ways
Northgate Logistics is a hypothetical regional distribution company; the audit, the people and the numbers are invented to show how one set of facts produces two different report ratings. Internal audit reviewed warehouse operations at the Columbus distribution center over nine weeks, covering inventory accuracy, physical security of high-value stock and inbound receiving. The scoping memo set the objective as “inventory at the Columbus DC is complete, accurately recorded and protected from loss.” The function rates findings Critical, High, Medium or Low on an impact-and-likelihood matrix and rates reports Satisfactory, Needs Improvement or Unsatisfactory using a derivation rule close to the one in the aggregation table above, including the rule that a High on a key control with no compensating control, or a repeat High, produces an Unsatisfactory. Fieldwork produced three findings.
| Ref | Condition, in one line | Impact and likelihood | Finding rating | Why it is rated there |
|---|---|---|---|---|
| F1 Cycle counts and adjustments | 31 percent of scheduled cycle counts in the first half of the year were not performed; of 212 inventory adjustments posted in the period (net $212,000 against on-hand inventory of $14.6 million), 187 were approved by the same shift supervisor who performed the count | Impact Major: misstatement and the ability to conceal shrink. Likelihood Likely: no independent approval, so the control over adjustments does not operate as designed | High | Cycle counting and adjustment approval were designated key controls in the planning memo; the gap is design, not a lapse |
| F2 High-value cage access | 14 of 86 active badges with after-hours access to the high-value cage belonged to people who had left the warehouse team or the company; access logs showed none had been used after the holders left; a cage sign-in log and CCTV cover the area | Impact Moderate: theft of high-value stock is bounded by the sign-in log and camera coverage. Likelihood Possible: the badges exist, but the second controls would detect use | Medium | Operating failure of the leaver process with two detective controls in place |
| F3 Trailer seal verification | In 9 of 40 sampled inbound shipments the seal number recorded at the dock did not match the carrier manifest, and none of the nine was investigated as the receiving procedure requires | Impact Moderate: in-transit loss or short shipment absorbed as shrink. Likelihood Likely: the exception path is not operating at all | Medium | A detective control with no follow-through; not a key control for the inventory objective in the planning memo |
Two Mediums with credible action plans do not, on their own, push this report below the top level. The report rating turns entirely on F1 and on three facts around it: whether a second control bounded the exposure, whether the fix was in place before the report, and whether the condition had been reported before. The table shows the engagement running both ways.
| Element | Path A: report rated Needs Improvement | Path B: report rated Unsatisfactory |
|---|---|---|
| Compensating control for F1 | The plant controller’s monthly review of the inventory reconciliation was evidenced for all six months, with two large variances queried and resolved in writing; the auditors credited it as bounding the exposure | The controller’s review existed in the procedure but could not be evidenced for four of the six months; no credit given |
| Action during fieldwork | Approval of adjustments was moved to the inventory control manager in week six; the system role change was evidenced by a ticket and the auditors confirmed the new approval operated for the final three weeks | The warehouse manager committed to the change at the closing meeting; nothing had changed when the report was issued |
| Prior audit history | Cycle counting had not been raised in a prior report | The same cycle-count condition was a Medium in the previous audit two years earlier, closed on a memo saying the count schedule had been reissued |
| F1 finding rating | High | High, flagged as a repeat; the methodology’s repeat rule applies |
| F2 and F3 | Medium and Medium | Medium and Medium |
| Derivation sentence in the report | “A High finding whose exposure was bounded by an operating compensating control and contained during fieldwork, with two Medium findings carrying agreed plans: Needs Improvement” | “A repeat High finding on a key control with no operating compensating control: Unsatisfactory” |
| Who saw what | The VP of operations and the CFO received the draft; the report appeared in the committee pack with a three-line summary; no questions were asked | The CAE briefed the CFO and CEO before issue; the report led the results section of the pack; the VP of operations attended the committee meeting |
| Follow-up | F1 validated by re-performance after 90 days of operation; F2 and F3 closed on evidence at their due dates; quarterly reporting until closed | Monthly status to the CFO and the audit function; all three findings validated by testing; the area’s risk score raised and a full follow-up audit scheduled within twelve months |
| What the manager did with the first week of fieldwork | Pulled the controller’s review emails and the role-change ticket, and asked the auditors which second controls they would credit | Argued that no stock had actually gone missing |
The facts of the warehouse were identical in both paths; everything that differed was within the warehouse manager’s reach months before the audit. In Path B the argument that no stock had gone missing is true, irrelevant under the definitions, and the single most common losing argument in rating disputes: likelihood is rated on the control, not on whether the loss has happened yet. What to do after a Path B result is the subject of Failed an Internal Audit?; how to write the action plans that close on the first validation in either path is in writing management action plans that actually close, and model wording for each position, from full agreement to a disputed rating, is in management responses to audit findings: 15 examples.
What is worth contesting, and what is not
Practitioner judgment, from the auditor’s side of several hundred of these conversations: rating challenges succeed when they change a fact the definition depends on, and fail when they appeal to anything else. Auditors keep a private tally of who argues from evidence and who argues from discomfort, and it follows a manager from engagement to engagement. The table sorts the common situations.
| Situation | Worth contesting? | Why | How |
|---|---|---|---|
| A fact in the finding is wrong (population, count, period, which control was tested) | Yes, always | Facts are the input to every rating; correcting one can move a cell | In writing, one point per line, with evidence that existed before the audit asked; during fieldwork if possible |
| Corrected facts put the finding in a different cell of the matrix | Yes | This is the only rating argument that reliably works | Show the definition, the evidence and the resulting cell; ask the audit manager to re-run the rating memo |
| A compensating control existed and operated but was not credited | Yes, if you can evidence operation for the period | Most methodologies drop a level for an operating compensating control | Produce the evidence of operation month by month, not the procedure that says it should happen |
| The gap was fixed and is operating before the report | Contest the rating only if the methodology gives containment credit; otherwise ask for acknowledgment | Standard 15.1 requires the final report to acknowledge actions already taken; it does not require the rating to change | Evidence the fix operating; ask for the acknowledgment sentence and, where the rule allows, the containment credit |
| The derivation rule was misapplied to correct finding ratings | Yes | The rule is the committee’s document; auditors will correct a misapplication | Quote the rule next to the finding ratings; escalate from audit lead to audit manager to CAE if needed |
| The cause is wrong | Yes | The cause drives the action plan; a wrong cause produces an action that will not close | Propose the cause with your working, and accept the action that follows from it |
| The condition wording is accurate but uncomfortable | Rarely | Accurate wording survives; arguing it spends credibility | Ask for precision where a word overstates (pervasive, systemic, management was aware); accept the rest |
| “No loss has occurred” | No | Likelihood is rated on the control condition, not on outcomes to date | Say nothing; put the energy into the response |
| “Other departments do the same thing” | No | It does not change your exposure; it may add their area to the plan | If the cause is shared, say so in the cause statement so the fix is organization-wide |
| “The rating will hurt my team’s scorecard” | No, and it is damaging to say | It confirms the appearance the methodology was built to prevent | Never say it to the auditors; if it is a real problem, it is a conversation with your executive |
| Finding ratings are right and the rule was applied correctly | No | There is nothing left to argue; the rating belongs to the CAE | Record any residual disagreement in one paragraph of the response and state what you will do anyway |
Three tests before you contest a rating. First, find the sentence in the methodology that your facts satisfy. If there is none, you are arguing with the methodology, which is the audit committee’s document rather than the auditor’s, and the place for that is a later conversation with the CAE about the definitions, not this engagement. Second, make sure the evidence existed before the audit asked for it; a document created afterward and presented as original ends your credibility for this engagement and usually the next one. Third, ask whether winning changes anything that matters. Moving a Medium to a Low rarely changes the report rating, the follow-up or who reads it; moving a High to a Medium almost always does. Spend your credibility where it buys something, accept the rest in writing, and put the energy into an action plan that closes on the first validation. That record, not the rating, is what the people above you remember.
This guide is general and educational; it is not legal or employment advice.
Questions readers ask
What does a Needs Improvement audit rating mean?
On a three-level scale it means the auditors found weaknesses serious enough to put the objective at risk but not serious enough to say the area cannot be relied on: typically one High finding whose exposure is bounded, or several Medium findings that together matter. The exact meaning is in your function’s written definition, which the IIA’s practice guide says should be communicated to management, usually in the report.
Is Needs Improvement a bad audit rating?
It is the middle of the scale, and a normal result for a process with real findings. It becomes a problem when the actions attached to it slip, when the same findings come back at the next audit, or when it is the third Needs Improvement in a row for the same area, because a pattern is read as a management issue rather than a control issue. One Needs Improvement with every action validated on time is, in practice, a good year.
Can one finding make a whole audit report Unsatisfactory?
Yes. Under most methodologies any Critical finding does so automatically, and a High finding on a key control with no compensating control, or a repeat High, does so too. Report ratings are floors and caps rather than averages, so a single serious gap outweighs any number of clean areas in the same scope. The IIA’s practice guide gives the example that one high and two medium findings should produce a conclusion of unsatisfactory or, at best, needs improvement.
Who decides the rating on an internal audit report?
Internal audit does. The audit team proposes finding ratings against written definitions, an audit manager calibrates them, and the chief audit executive approves the report and its overall rating under Standard 15.1. The audit committee typically approves or concurs with the methodology the ratings come from and sees the results, but does not set individual ratings. Management is entitled to state its position, and Standard 13.1 requires a process for that, but the final word on the rating belongs to the CAE.
Can management change an internal audit rating?
Management cannot change it directly, but it can change the facts the rating rests on: correct an error in the population or the count, evidence a compensating control that operated, show that a gap is isolated rather than systemic, or demonstrate a fix running before the report. Applied to the written definitions, corrected facts often produce a different cell. Appeals to a CEO or board member to overrule the rating are seen as pressure on the function’s independence and tend to make the final report worse, not better.
Does an internal audit rating affect performance reviews or bonuses?
It depends on your employer, not on internal audit. As a practitioner observation rather than a rule, in many organizations, particularly in financial services, audit ratings and overdue audit actions feed management scorecards and can affect variable pay; in many others nothing formal happens. What leadership consistently judges is the response: whether facts were corrected with evidence, whether dates were met, and whether the findings came back.
How long does an audit rating stay on record?
The report itself is permanent, but its practical life is the time it takes to close the findings plus the gap to the next audit. Open findings are reported by rating every quarter until validated, and the last report rating feeds the risk assessment that decides when the area is audited again. A bottom rating usually brings a follow-up audit within about a year; a clean follow-up with no repeats is what retires the earlier result.
What is the difference between a finding rating and an audit opinion?
A finding rating (High, Medium, Low) measures the severity of one control gap on impact and likelihood. An audit opinion, overall rating or engagement conclusion (Satisfactory, Needs Improvement, Unsatisfactory, or Substantial, Reasonable, Limited, No Assurance) is the auditors’ conclusion on the area as a whole, derived from the finding ratings by a rule. Above both may sit a CAE conclusion at division or organization level, built from several engagement conclusions and often expressed on the same scale.
Related guides
- Being Audited? hub — every guide written for the people on the receiving end of an audit.
- Failed an Internal Audit? What an Unsatisfactory Rating Means and What to Do Next — the first 72 hours, the first 90 days and the committee appearance after a bottom rating.
- Finding Severity Ratings: The Calibrated Matrix, Twelve Cases and the Report Rating Rule — the auditor-side method for rating individual findings, with the grid and the rating memo.
- When You Disagree With an Internal Audit Finding: How to Dispute It Properly — the windows, the evidence weights and the response wording for a dispute.
- The Draft Audit Report Has Landed: How to Review It in 48 Hours — what you can still change in the draft, including a rating within the definitions, and what you cannot.
- Reporting to the Audit Committee: The Quarterly Pack — how ratings, overdue actions and repeats appear in front of the committee.
- Writing Management Action Plans That Actually Close — owner, date, evidence of completion and the interim measure.
- Risk Acceptance by Management — the right process for letting an audit issue go when the action will not be done.
- Compensating Controls: When Plan B Is Good Enough — when a second control is good enough to change the picture, and when it is not.
- The Life of a Finding — one issue followed from fieldwork observation to closed issue.
- Evaluating Control Deficiencies: From Exception to Material Weakness — the SOX severity ladder that runs alongside internal audit ratings.
- The Escalation Ladder — when and how auditors go over someone’s head, and what triggers each rung.
- Living With Internal Audit Year-Round — building the record between audits that keeps the next rating up.
- Anatomy of an Internal Audit Report — the structure of the report your rating arrives in, section by section.
Leave a Reply