Classifying audit findings by significance

An audit report has 22 findings, all written in the same tone. The director reads them and has no idea where to begin: "no labels on mixed pallets" sits next to "one employee receives, enters and writes off goods". Usually the easy jobs get done and the most important waits. A significance level puts findings in order: it shows which one to tackle today and which belongs in the quarterly plan.

Three levels

• High: risk of serious financial loss or a breach of rules, with no control or one that is bypassed. Deadline: usually 30 days.
• Medium: a control exists but is insufficient or is breached from time to time. Deadline: 60–90 days.
• Low: small impact, a shortcoming at the level of tidying up. Deadline: the next plan, or monitoring.

Do not multiply the levels. Three are clear to management; five invite argument.

Three criteria

The level rests not on the auditor's mood but on written criteria:

1. Size of impact: in so'm, relative to annual turnover, and in terms of reputation and legal consequences.
2. Recurrence: a one-off case or a systemic one that repeats daily.
3. Control: none at all, partial, or present but not working.

Each criterion is scored from 1 to 3 and the sum gives the level: 3–4 low, 5–6 medium, 7–9 high.

Agree a numerical threshold for the size of impact in advance. For example, for a company with annual turnover of 12 billion so'm, an annual loss risk above 0.5% (60 million so'm) scores 3, between 0.1% and 0.5% (12–60 million so'm) scores 2, and anything lower scores 1. This is only an example: you set the threshold together with management, and the auditor applies it to every finding in the same way.

An example: a wholesale food warehouse

A. One employee receives goods, enters them in 1C and writes them off. Impact 3 (a large annual shortage risk), recurrence 3 (daily), control 3 (none). Total 9, level high.

B. No labels on mixed pallets. Impact 1 (picking takes longer, no money is lost), recurrence 3, control 2 (labels are sometimes there). Total 6, level medium.

C. Location marks have worn off on 12 racks in the reserve zone. Impact 1, recurrence 1 (one zone), control 2. Total 4, level low.

As a result the director sees not 22 findings but 3 high, 8 medium and 11 low, and knows what to attend to first.

Factors that change the level

Scoring is an aid, not a verdict. The level goes up one step if:

• there is a sign of fraud, even when the sum is small;
• a legal or contractual requirement has been breached;
• the finding also appeared in the last audit and was not fixed;
• one weakness disables other controls as well.

A compensating control lowers it: the main control is missing, but a second check at another stage catches the error.

Level and response

The level also sets the degree of accountability. For high findings the owner is the director or deputy, for medium the department head, for low a specialist. In the report the level is shown beside the finding in colour or in words, and the reason is recorded, not only the colour.

A level is not fixed for ever. Once a control is introduced it falls at the next review; if the finding recurs it rises. Record changes with the date.

Common mistakes

• Marking every finding "high". The level loses meaning, and management gives everything the same attention.
• Scoring without criteria: two auditors give the same finding different levels.
• Changing a level at the audited party's request. Only new evidence can change a level.
• Judging by the sum alone: a finding with a small sum but a sign of fraud stays at a low level.
• A level with no owner or deadline: it is of no use until tied to a plan.

Conclusion

Not every finding matters equally, and showing management this is the auditor's job. OmborAudit rates findings by impact, recurrence and control and hands them over in priority order, so the recommendations plan starts exactly where it matters most.