1. Introduction to the Tool/Technique
Materiality and Risk Rating is a critical evaluation method used in internal audit to determine the significance of audit findings. It supports prioritization by assigning ratings based on impact and likelihood. This allows stakeholders like CEOs and project leads to focus on the most pressing risks while ensuring compliance and performance across the organization.
Auditors typically evaluate findings across several dimensions:
Financial Impact – Dollar value of potential loss or error
Compliance Impact – Legal/regulatory exposure
Reputational Impact – Possible brand damage
Likelihood – Chance of the issue recurring
These are then used to assign an overall Materiality and Risk Rating (Low, Medium, High), often guiding audit recommendations and management’s next steps.
2. Dataset: ACME Corp Internal Audit Findings Q2 2025
Internal Auditor Auren has just wrapped up a quarter-end internal audit at ACME Corp. He identified five key findings across departments, working with Project Manager Aven and reviewed the results with CEO Liora:
| Finding ID | Description | Area | $ Impact | Reput. Impact | Compl. Impact | Likelihood |
|---|---|---|---|---|---|---|
| FND-001 | Delayed invoice approvals | Accounts Payable | $1,500 | Low | Medium | Medium |
| FND-002 | Shared logins | IT | $0 | High | High | High |
| FND-003 | 3 months unreconciled account | Finance | $25,000 | Medium | High | Medium |
| FND-004 | No data backups | Operations | $0 | Medium | Medium | Low |
| FND-005 | Poor vendor vetting | Procurement | $5,000 | High | High | Medium |
3. Practical Template in Excel
To document this, Auren uses a Materiality and Risk Rating Matrix in Excel. The columns include:
Finding ID and Description
Area/Department
Financial, Reputational, and Compliance Impacts
Likelihood
Materiality Rating (based on impact)
Overall Risk Rating
Auditor Comments
Recommended Action
Using drop-downs for impact and likelihood ensures standardization. Conditional formatting helps visually highlight high-risk areas.
You can download the completed template here.
4. Application at ACME Corp
Auren met with Aven and Liora to walk through each finding using the template:
High-Risk: FND-002 (Shared System Login)
While there’s no direct financial impact, the reputational and compliance risks are severe. Shared logins violated ACME’s own policy and exposed sensitive systems to unauthorized access. Auren rated this finding “High” across all dimensions. Liora committed to enforcing individual logins and implementing multi-factor authentication.High-Risk: FND-003 (Unreconciled Bank Account)
With a $25,000 exposure and delayed reconciliation, this was also rated “High.” Auren highlighted the risk of fraud or error going unnoticed. The Finance team was tasked to complete reconciliations monthly and implement a cross-review process.Medium Risk: FND-004 (Missing Backup Process)
Although financial loss isn’t immediate, the potential operational disruption is serious. The Operations Team agreed to implement an automated daily backup system.Low Risk: FND-001 (Delayed Invoice Approvals)
This was more of a process bottleneck with minor penalties, so it received a “Low” rating. Auren suggested using workflow automation tools for reminders.
The risk rating matrix empowered ACME to distinguish between nuisances and mission-critical issues, allowing smart allocation of time and budget.
Upon reading the Disclaimer, a reader may click the link below to download an example of a relevant tool: