Thread Options 
|
#213671 - 07/21/04 01:07 PM
Rating Internal Audit Reports
|
Anonymous
Unregistered
|
Does anyone rate each individual internal audit report after the audit is complete (and based on the findings)? For example, assign a "fair" to a wire transfer report. We have examiners in-house and they suggest this is something to include in the audit manual, or a reason why we do not do this. Any thoughts??
|
|
Return to Top
|
|
|
|
#213672 - 07/21/04 01:10 PM
Re: Rating Internal Audit Reports
|
10K Club
Joined: Nov 2003
Posts: 12,846
|
Management asked me to do this last year. I assign a risk due to materiality, and a risk due to complexity in my risk assessment when I recommend a schedule to the audit committee. After completing the audit, I assign a control risk based on the findings in the audit.
It has worked pretty well, I think.
|
|
Return to Top
|
|
|
|
|
#213673 - 07/21/04 01:13 PM
Re: Rating Internal Audit Reports
|
Anonymous
Unregistered
|
May I ask what categories you use when assigning a risk based on findings...i.e. high, med, low or poor, fair, good, etc.?
|
|
Return to Top
|
|
|
|
|
#213674 - 07/21/04 01:49 PM
Re: Rating Internal Audit Reports
|
10K Club
Joined: Nov 2003
Posts: 12,846
|
I use high, medium, and low risk.
|
|
Return to Top
|
|
|
|
|
#213675 - 07/21/04 01:53 PM
Re: Rating Internal Audit Reports
|
Diamond Poster
Joined: May 2004
Posts: 1,475
Big Brother knows and that's a...
|
We rate all of our audit reports. They are rated satisfactory, needs improvement, and unsatisfactory. There are 3 levels in each category depending on the number of findings. In addition, we put the risk score on each report. We were asked by the OCC examiners 2 years ago to put the prior audit grade and prior audit risk score on each report to do a comparison from the prior audit to the current audit also.
If you would like to see our grading policy, I would be happy to share it with you....just PM me.
_________________________
My opinion is mine only- not my employer's!
|
|
Return to Top
|
|
|
|
|
#213676 - 07/21/04 03:02 PM
Re: Rating Internal Audit Reports
|
Diamond Poster
Joined: Jun 2002
Posts: 1,815
Minnesota
|
We also assign each audit an audit rating. The rating is listed on the final audit report, along with the previous audit's rating. The ratings are 3 tier; satisfactory, needs improvement and unsatisfactory. Each exception item is given an individual rating and is based on severity of the item.
_________________________
Do what you can, with what you have, where you are.
~Theodore Roosevelt~
|
|
Return to Top
|
|
|
|
#213677 - 07/21/04 08:12 PM
Re: Rating Internal Audit Reports
|
Gold Star
Joined: Dec 2002
Posts: 345
New England
|
When we were in-house, we rated Satisfactory, Satisfactory with Comment, and Unsatisfactory. Our outhouse  (outsourced) auditors do not rate their reports. Our rating system came out of a recommendation from a regulatory exam about 7-8 years ago. We were very specific about the rating, 3 or more comments regarding violations of policy, procedure, law, regulation made the report unsatisfactory.
_________________________
Its risky business, but someone has to do it.
|
|
Return to Top
|
|
|
|
|
#213678 - 07/21/04 08:13 PM
Re: Rating Internal Audit Reports
|
Gold Star
Joined: Dec 2002
Posts: 345
New England
|
Hey Jokerman, your presence is requested in the HR forum "What the Heck are you Thinking?" discussion.
_________________________
Its risky business, but someone has to do it.
|
|
Return to Top
|
|
|
|
|
#213679 - 07/21/04 08:44 PM
Re: Rating Internal Audit Reports
|
New Poster
Joined: Mar 2004
Posts: 2
Northeast
|
We rate our audit reports using strong, good, acceptable, marginal, and unsatisfactory. We also include a small definition for each of the ratings.
_________________________
Opinions are all mine.
|
|
Return to Top
|
|
|
|
|
#213681 - 07/22/04 11:56 AM
Re: Rating Internal Audit Reports
|
Anonymous
Unregistered
|
I rate my reports outstanding, satisfactory, needs improvement or unsatisfactory. However, I am considering removing ratings because some senior managers include the audit rating in employee job performance reviews. I really don't like being blamed for a bad performance review or a low salary increase because I assigned a "needs improvement" rating. I prefer that the manager draw their own conclusion about the rating. Let the audit results speak for themselves.
|
|
Return to Top
|
|
|
|
|
#213683 - 07/22/04 03:00 PM
Re: Rating Internal Audit Reports
|
10K Club
Joined: Nov 2003
Posts: 12,846
|
Quote:
During closing meetings, sometimes management focuses more on the "rating" than the recommendations and process improvements that are pointed out, which are the most important part.
Any solution?
|
|
Return to Top
|
|
|
|
|
#213684 - 07/22/04 03:57 PM
Re: Rating Internal Audit Reports
|
New Poster
Joined: Mar 2004
Posts: 2
Northeast
|
Our auditees have started to do their own self-assessments using policy and procedures, regulations and prior audit comments as a guideline. Overall I would say it does help with the next audit rating.
_________________________
Opinions are all mine.
|
|
Return to Top
|
|
|
|
|
#213686 - 07/23/04 01:58 PM
Re: Rating Internal Audit Reports
|
10K Club
Joined: Nov 2003
Posts: 12,846
|
Quote:
My solution is the have enough documentation to support my conclusions. Don't get me wrong, everything that I include in my audits are valid recommendations and they are required to provide corrective actions. I stand strong in my audit rating and point out the good things that the particular department does and stress that after making the noted improvements, possibly obtain a better rating next time.
Yeah, I just get the same thing - I'm trying to focus on this glaring control weakness, but management wants to know, well, how bad is this area, say, compared to ... whatever else I've audited recently.
|
|
Return to Top
|
|
|
|
|
#213687 - 07/23/04 03:44 PM
Re: Rating Internal Audit Reports
|
Gold Star
Joined: Jul 2002
Posts: 338
Hell's Canyon
|
From the IIA performance standards: Implementation Standard 2410.A2 (Assurance Engagements) Quote:
Internal auditors are encouraged to acknowledge satisfactory performance in engagement communications.
We didn't want to grade the reports either, but at least our people won't have performance reviews based on the outcome of an audit. In my opinion this takes away from the independence of an audit. There are better ways to deal with an unsatisfactory audit!
There had also been some previous questions about developing a follow up process. We were told by the state examiners to ensure the Audit Committee is made aware of all outstanding issues. Per this auditing standard, audit is responsible for monitoring:
Performance Standard 2500 Monitoring Progress
Quote:
Monitoring Progress
The chief audit executive should establish and maintain a system to monitor the disposition of results communicated to management.
Implementation Standard 2500.A1-1 (Assurance Engagements)
Quote:
The chief audit executive should establish a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action.
Not to be a wet blanket, but I went through the same issues and did some research. I like to see things in black and white before I spend my time developing something one regulator thinks is necessary, but isn't actually required.
_________________________
Wendy LaVoie
|
|
Return to Top
|
|
|
|
|
#213688 - 07/23/04 09:23 PM
Re: Rating Internal Audit Reports
|
Junior Member
Joined: Mar 2004
Posts: 39
Alaska
|
We have four ratings. Excellent if it is very clean. Satisfactory, which most audits fall into. Needs Improvement, some significant problems but management is responsive to correcting, and we follow up audit in 6 months. Unsatisfactory, serious problems, unresponsive management, and/or failure to correct issues from a Needs Improvement audit, and another 6 month follow up audit.
|
|
Return to Top
|
|
|
|
|
|
Previous Thread
Index