Internal auditors use a variety ratings or opinions for their reporting, despite a trend of not using them.
There is a growing trend of internal audit departments moving away from using audit opinions, or ratings, to rate the progress of a mitigation effort. The idea is to focus on the audit issue itself and mitigate it. Despite this trend, many auditees and audit committee members are happy with the current system and push back against suggestions to get rid of ratings.
Following an audit of a process, the auditee gets a rating or opinion on the progress they’ve made on fixing the process – the audit issue. Ratings methods differ; some employ colors. Green generally means good while colors like yellow or orange mean “needs work” or “needs improvement;” red means things are bad and not being addressed at all. “I’ve never seen a red since I’ve been an auditor,” one member said at a recent virtual meeting of NeuGroup’s Internal Auditors’ Peer Group (IAPG).
In the meeting, members described their various rating scales – no two the same – and said in some cases they were asked to move away from them. One reason for this was that many of the functions being audited focused too much on the rating and not on the underlying issue. “The (audit) finding gets lost,” said one auditor.
- But auditors say they get pushback when they discuss moving away from ratings. “Execs like the overall rating because they don’t have to read the whole audit report,” said one IAPG member. Added another member, “Audit reports sometimes have too many pages. [AC members and executives] will read through them and then ask, ‘what’s important here?’ So the ratings and colors are needed.”
And despite the industry effort to drop ratings, some IAPG members have actually added more rating categories to their scales. Several members who have three ratings for findings, typically along the lines of “satisfactory,” “needs improvement” and “ineffective” or “unsatisfactory,” have added more nuance. In a few cases they have split the middle rating, “needs improvement,” into “moderate improvement opportunity” and “needs significant improvement.”
Language matters. Members also mentioned that there’s sometimes pushback over the language of ratings.
- For one member, the legal department made IA change the red rating “ineffective” to “major improvement needed.” This was because, in the case of a lawsuit, ineffective could be misconstrued and create a problem.
- Another member mentioned that sometimes auditees, particularly millennials, take issue even if their mitigation efforts are good or get the top rating. In this member’s case, that rating is “satisfactory,” which to some ears sounds mediocre or worse. But the auditor said it’s not his job to say it’s anything more than that.