I have received the following comment from one of my client. I appreciate your input.

There are no serious audit findings that could conform to the "dissatisfactory" rating definition appended above.
Nowhere in the report has any evidence been presented of lack of controls that could lead to financial loss or irregularity.

The department has been subjected to various independent audits throughout the years. The latest was on behalf of Regulatiors. None of these audits have had unfavorable comments re: Thepossibility of financial risk or loss to the bank.

Unsatisfactory " ratings imply very serious control failures and violations that could subject the bank to serious financial losses. The audit report does not substantiate this and external audit reports have also not pointed out any serious defects within the department.

In the light of the above, we do no agree with the rating as it is unjust, unfair and uncalled for and has no material basis and footing at all. We therefore, demand very strongly on the basis of all factual findings (not hypothetical) that the rating should be changed minimum to a satisfactory level.

It would be impossible for me to comment not knowing what violations were cited, the history of the client and what may have changed on their part.

These are the types of issues that should be discussed during an exit review or review of the draft report. If you feel the report is true and correct and that the violations cited are substantive, you may have no choice. While you can tone down the report, you increase your reputational risks.

Too little information, but here are some thoughts...

If this is the first time you are hearing about the auditee's disagreement, there is a major problem. These issues should have been discussed thoroughly, throughout the audit process and, like Andy mentions, in an exit meeting. Communication during the audit and then exit meetings are always important to the communication process, but they are critical when a less than satisfactory rating is being assigned.

Also, the auditee indicated that the report did not mention any internal control problems or otherwise support the less than satisfactory rating. IF that is the case, he is correct. The audit report should always include the basis for the rating.

Hard to draw any other conclusions due to the lack of specifics...

The amount of information provided was minimal to make an objective decision, but:

Define “serious” – there could have been a significant number of “almost serious” findings. What may be serious for the auditor as a control breakdown may be a common business practice for the department.

There are many types of controls, including compensating. While the report did not present evidence of lack of controls, it did not appear to say there was an overabundance of controls either. Processes, procedures, responsibilities and systems are everchanging. A control over scanners would not have been mentioned 5 years ago, but now, they can be used to duplicate and change virtually every document in the bank.

While not having exceptions mentioned by regulators is a good thing, they are not the ultimate in detectives. If it’s not in their examination program, they usually don’t have the time to mess with it. Examiners look for violations of banking law, and not deeply involved in internal controls. It’s difficult to walk in, sit at a desk removed from everything except what’s handed to you, and analyze controls to the same extent as someone who’s living with them for 365 days a year.

More so with external auditors. Grunts do the work and the managers take the CEO/CFO’s out for lunch. If you don’t believe me, just look how the materiality factor increases exponentially the closer it comes to sign-off day.

From what was mentioned, it seems that there was not a meeting of minds on the importance of certain facets and controls, before, during and after the audit. If all that was said is true, then Unsatisfactory might be a bit harsh.

I had a staff auditor review the REO department and write the report. It was extremely detailed, and had the same firepower as a Warthog after a tank in Iraq. I asked him to sit at my desk and read all 34 pages of the report, as if it were addressed to him and he had to respond to Senior Management. 20 minutes later, he was pale and re-writing it. The original report would have set back relations with REO about 15 years. We got the same results and a great good will with the re-write.