Our risk indication in our audit shop is below. Can I have your comments on it? Thanks

Low Audit finding, the solution to which may lead to improvement in the quality and/or efficiency of the organizational entity or process being audited. Risks are limited. Routine management attention is warranted.

Medium Audit finding that may lead to: (1) financial losses; (2) loss of controls within the organizational entity or process being audited; (3) reputational damage; and/or (4) adverse regulatory impact. Timely management attention is warranted.

High Serious audit finding that may lead to: (1) substantial financial losses, possibly in conjunction with other weaknesses in the control framework of the organizational entity or process being audited; (2) serious violation of corporate strategies, policies or values; (3) serious reputational damage; and/or (4) significant adverse regulatory impact. Immediate management attention is required.

Joe,
I think it looks good! However, this issue is so subjective and hard to quantify. Who decides what is substantial, serious or significant?