Walk a Finding From Evidence to Rating
Use criteria, condition, cause, and effect to rate an audit finding.
Audit fork A draft report calls a vendor due-diligence gap "high" because the sample failed badly. The COO challenges the rating, saying no vendor incident occurred and Audit is overstating the issue. The internal audit skill is deciding what evidence would change a governance decision, not collecting comfort material. Practice turning evidence into a fair severity rating. IIA finding communication and risk significance Finding severity should flow from risk consequence and likelihood, supported by evidence and criteria. A high fail rate matters, but the rating is stronger when it connects to exposure, compensating controls, and stakeholder decision needs. Severity is…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in