How are you thinking regarding risk ratings being used for the findings within an Audit Report? Are there any changes to the approach?

We risk rate all findings that rise to the level of an "issue". That criticality rating drives overall audit rating - Satisfactory, unsatisfactory, needs improvement. All Med and High issues are reported to the Audit Committee, based on status updates from management. Risk definitions are tied to ERM framework. 

We rate every finding in our audit reports as we find that it helps out senior leaders understand relative severity in order to assist with prioritization and resourcing taken within the context of the broader set of initiatives their teams are working on.   We've recently revisited our rating scales to ensure that they are still appropriate given the overall company risk appetite. We also made updates to the language we use for our ratings, to improve our ability to communicate the ratings to our internal clients.

We use risk ratings for every audit finding that we report.  This is used to drive the speed of implementation of the remediating actions.  However, no matter what the risk rating is the actions need to be completed by the due date, with the Board getting an update each quarter of progress against implementation of actions and any overdue actions.

I agree that risk ratings are beneficial in allowing stakeholders to develop risk-based remediation plans (or risk acceptance decisions) and prioritize resources. We have adopted the risk ratings scale in our organization's risk management standards to promote consistency amongst assurance providers.

Risk ratings are always beneficial in understanding the importance of a finding and how critical it can be for the company. This can also give enough guideline to focus on either improving an existing control or introduce a new one to bring down the risk to lower possible.