Hello,

Do you rate individual audit findings on audit reports or just give an overall rating for the entire report? Has an examiner every stated you had to rate individual audit findings on the audit report?

Yes, I do.

High
Moderate
Low

Each is defined in the audit manual.

I rate both individual audit findings and the entire audit report. The individual audit findings are given a diamond rating from 1 to 4. With 4 being the highest risk.

I rate the audit as a whole. If the audit is rated 'needs to improve' or 'unsatisfactory', then the general factors that contributed to the rating are listed at the end of the audit letter in the rating section. (internal controls are not adequate to ensure compliance, etc)

Thanks for the responses. For those of you who do rate the individaul findings in the audit report - was it as a result of an examiner "suggesting" that you do so?

My scenario - we provide an overall rating for the audit report only. Examiner says we need to also put individual ratings for each finding within the report...because other banks they have examined do so. Frustrating.

We've always rated individual findings.

Got criticized once way back when for not rating overall reports. Those get rated too.

Something in the back of my mind is telling me IIA guidance suggests this - don't quote me on that though.

No. It was not the result of an exam recommendation. It also helps our Audit Committee understand which exceptions are significant.

Thanks for the responses...tired of having to do something just because examiner A says other banks do it. Then later examiner B says do something else....and so on and so on.