The practice of including ratings in internal audit reports to highlight or summarize results is not something new. I began exploring and lecturing on the pros and cons of ratings more than 10 years ago. But the subject came up recently at a CAE roundtable, reminding me how popular — yet controversial — the practice continues to be.
Almost 40 percent of those in the room use ratings in some form, and the last time I formally surveyed on the practice, more than two-thirds of respondents said they were including ratings in their audit reports.
Ratings are often assigned based on the overall results of the audit, and they can take on adjectival forms, such as “satisfactory,” “needs improvement,” or “unsatisfactory.” More creative approaches include assignment of ratings to individual findings, or using color-coded indicators, such as green, yellow, red. Regardless of the methodology, the objective for assigning ratings is typically the same: It is a powerful way to draw management and the board’s attention to the bottom line of an internal audit.
From my experience, executive management and the audit committee tend to have the greatest appreciation for ratings. They enable them to quickly focus on what’s important in the internal audit report. A CEO once told me that, when he received an internal audit report, he looked first at the overall rating. If it was “satisfactory,” he said, he “threw it in the trash can.” If the rating was “needs improvement,” he placed it in his in-box for review the next day. And, if the result was “unsatisfactory,” he stuck the report in his briefcase to read on the train home that evening.
Meanwhile, an audit committee chairman observed that ratings can “shine a light” and help the audit committee quickly focus on the most important findings in a report. However, while ratings may be a “light” for some, they are ultimately a “lightning rod” for others.
Ratings can be a powerful tool, but if management and the audit committee place undue emphasis on them, they tend to have a polarizing effect on line and operating managers whose performance ends up being summarized in a single word: “unsatisfactory.” In a lecture I delivered several years ago, I summarized the undesirable consequences of ratings in internal audit reports:
It would be easy to conclude that ratings are more trouble than they are worth. But it is important to remember that internal audit’s key stakeholders often derive a lot of value from them. So, before you make a hasty retreat from this practice, it would serve you well to have an extensive discussion with executive management and the audit committee. For those who do use ratings in internal audit reports, there are five important points to remember to mitigate some of the challenges:
Good luck as you grapple with ratings. I welcome your thoughts on how to enhance the process.