For internal audit reports, do you provide an overall opinion? Can you share how you are able to go about this especially when there are multiple risks identified and different risk rankings?
Sort by:
We do provide one of 3 audit ratings on each report. The rating is not tied to a specific risk, it is a rating of the effectiveness of the controls that are within the scope of the audit, and usually for a specific business process or processes. So the design and operating effectiveness of the controls, along with some elements of inherent risk, will determine the likelihood of a control failure. The type of control failure and the associated risk or risks (along with other elements of inherent risk) will determine the impact. High likelihood and high impact will drive a lower report rating, and vice versa. So it's not single risk specific, but we're not rating the risk; we're rating the controls over the process that is in scope. Happy to discuss if helpful.
Audit reports have a conclusion of Satisfactory, Needs Improvement, or Unsatisfactory.
Yes, an overall conclusion of Controlled, Controlled with Opportunities for Improvement, Improvement Needed or Unsatisfactory. From my experiences, these conclusions are made with the joint review of the Senior Internal Auditor, Internal Audit Dept Manager and VP of Internal Audit to be made on the final report which includes Findings, Management Responses and Oppurtunities for improvement. Risks are highly dependent on the type of audit and whether there are any regulatory components.
I've worked for internal audit shops that did and did not provide overall opinions in the report. Although when opinions are not in the report, we had an internal process to tag an audit with an opinion for board reporting and our own needs. The biggest headaches providing opinions in audit reports is the auditee spends time negotiating/ appealing/ arguing the audit opinion, rather than the issues themselves. Further to that, providing ratings for individual findings results in similar communications with clients who, instead of spending time discussing the finding, only want to discuss the rating. When no opinion is in the report, the report does state that the audit findings are in order of importance and all the findings in the report are ranked higher than a low priority finding. The low items are communicated in a separate report, by the way. I have heard, off the record from colleagues, those instances where auditees patted themselves on the back for turning "highs" into "mediums" in the audit report, and passed on spending any quality time discussing the merits of the issue among themselves.
As far as balancing the opinion against the collective risks and rankings, it is grey area. We still define how to reach a given opinion, and the end result from years of audits can have the opinions summarized to look like a bell curve. The tails of the bell curve have a lower number of good and unacceptable opinions, while the majority opinions are either fair or poor. Consider, basing the overall opinion according to how much you think a higher level of management is needed to fix/ close the issues [i.e., get involved]. If you try to have a formula, based on rankings of individual findings and ratings, you'll get frustrated and so will the auditee trying to understand your logic. If you must insert opinions in the report, define the opinions according to the urgency for senior management's intervention. this question was posed in the Peer Community a few years ago, and my experience over that time hasn't changed with regard to opinions and rankings of risks and issues.