{"id":945,"date":"2020-04-04T14:57:48","date_gmt":"2020-04-04T14:57:48","guid":{"rendered":"https:\/\/alminawi.com\/?p=945"},"modified":"2020-04-04T14:57:48","modified_gmt":"2020-04-04T14:57:48","slug":"tts-series-e-internal-audit-evaluation-conclusion-techniques-episode-07-materiality-and-risk-rating","status":"publish","type":"post","link":"https:\/\/e.americanpro.org\/?p=945","title":{"rendered":"T&#038;Ts Series E, Internal Audit, Evaluation &#038; Conclusion Techniques, Episode 07\u2014 Materiality and Risk Rating"},"content":{"rendered":"<p data-start=\"153\" data-end=\"564\"><strong data-start=\"153\" data-end=\"194\">1. Introduction to the Tool\/Technique<\/strong><br data-start=\"194\" data-end=\"197\" \/>Materiality and Risk Rating is a critical evaluation method used in internal audit to determine the significance of audit findings. It supports prioritization by assigning ratings based on impact and likelihood. This allows stakeholders like CEOs and project leads to focus on the most pressing risks while ensuring compliance and performance across the organization.<\/p>\n<p data-start=\"566\" data-end=\"629\">Auditors typically evaluate findings across several dimensions:<\/p>\n<ul data-start=\"630\" data-end=\"1008\">\n<li data-start=\"630\" data-end=\"694\">\n<p data-start=\"632\" data-end=\"694\"><strong data-start=\"632\" data-end=\"652\">Financial Impact<\/strong> \u2013 Dollar value of potential loss or error<\/p>\n<\/li>\n<li data-start=\"695\" data-end=\"746\">\n<p data-start=\"697\" data-end=\"746\"><strong data-start=\"697\" data-end=\"718\">Compliance Impact<\/strong> \u2013 Legal\/regulatory exposure<\/p>\n<\/li>\n<li data-start=\"747\" data-end=\"796\">\n<p data-start=\"749\" data-end=\"796\"><strong data-start=\"749\" data-end=\"772\">Reputational Impact<\/strong> \u2013 Possible brand damage<\/p>\n<\/li>\n<li data-start=\"797\" data-end=\"1008\">\n<p data-start=\"799\" data-end=\"1008\"><strong data-start=\"799\" data-end=\"813\">Likelihood<\/strong> \u2013 Chance of the issue recurring<br \/>\nThese are then used to assign an overall <strong data-start=\"887\" data-end=\"902\">Materiality<\/strong> and <strong data-start=\"907\" data-end=\"922\">Risk Rating<\/strong> (Low, Medium, High), often guiding audit recommendations and management\u2019s next steps.<\/p>\n<\/li>\n<\/ul>\n<hr data-start=\"1010\" data-end=\"1013\" \/>\n<p data-start=\"1015\" data-end=\"1072\"><strong data-start=\"1015\" data-end=\"1072\">2. Dataset: ACME Corp Internal Audit Findings Q2 2025<\/strong><\/p>\n<p data-start=\"1074\" data-end=\"1286\">Internal Auditor Auren has just wrapped up a quarter-end internal audit at ACME Corp. He identified five key findings across departments, working with Project Manager Aven and reviewed the results with CEO Liora:<\/p>\n<div class=\"_tableContainer_16hzy_1\">\n<div class=\"_tableWrapper_16hzy_14 group flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<table class=\"w-fit min-w-(--thread-content-width)\" style=\"width: 83.7477%;\" data-start=\"1288\" data-end=\"1856\">\n<thead data-start=\"1288\" data-end=\"1374\">\n<tr data-start=\"1288\" data-end=\"1374\">\n<th style=\"width: 10.9785%;\" data-start=\"1288\" data-end=\"1301\" data-col-size=\"sm\">Finding ID<\/th>\n<th style=\"width: 26.7303%;\" data-start=\"1301\" data-end=\"1315\" data-col-size=\"sm\">Description<\/th>\n<th style=\"width: 15.1551%;\" data-start=\"1315\" data-end=\"1322\" data-col-size=\"sm\">Area<\/th>\n<th style=\"width: 9.06921%;\" data-start=\"1322\" data-end=\"1333\" data-col-size=\"sm\">$ Impact<\/th>\n<th style=\"width: 11.6945%;\" data-start=\"1333\" data-end=\"1346\" data-col-size=\"sm\">Reput. Impact<\/th>\n<th style=\"width: 13.6038%;\" data-start=\"1346\" data-end=\"1360\" data-col-size=\"sm\">Compl. Impact<\/th>\n<th style=\"width: 11.0979%;\" data-start=\"1360\" data-end=\"1374\" data-col-size=\"sm\">Likelihood<\/th>\n<\/tr>\n<\/thead>\n<tbody data-start=\"1465\" data-end=\"1856\">\n<tr data-start=\"1465\" data-end=\"1556\">\n<td style=\"width: 10.9785%;\" data-start=\"1465\" data-end=\"1475\" data-col-size=\"sm\">FND-001<\/td>\n<td style=\"width: 26.7303%;\" data-start=\"1475\" data-end=\"1503\" data-col-size=\"sm\">Delayed invoice approvals<\/td>\n<td style=\"width: 15.1551%;\" data-start=\"1503\" data-end=\"1522\" data-col-size=\"sm\">Accounts Payable<\/td>\n<td style=\"width: 9.06921%;\" data-start=\"1522\" data-end=\"1531\" data-col-size=\"sm\">$1,500<\/td>\n<td style=\"width: 11.6945%;\" data-start=\"1531\" data-end=\"1537\" data-col-size=\"sm\">Low<\/td>\n<td style=\"width: 13.6038%;\" data-start=\"1537\" data-end=\"1546\" data-col-size=\"sm\">Medium<\/td>\n<td style=\"width: 11.0979%;\" data-start=\"1546\" data-end=\"1556\" data-col-size=\"sm\">Medium<\/td>\n<\/tr>\n<tr data-start=\"1557\" data-end=\"1615\">\n<td style=\"width: 10.9785%;\" data-start=\"1557\" data-end=\"1567\" data-col-size=\"sm\">FND-002<\/td>\n<td style=\"width: 26.7303%;\" data-start=\"1567\" data-end=\"1583\" data-col-size=\"sm\">Shared logins<\/td>\n<td style=\"width: 15.1551%;\" data-start=\"1583\" data-end=\"1588\" data-col-size=\"sm\">IT<\/td>\n<td style=\"width: 9.06921%;\" data-start=\"1588\" data-end=\"1593\" data-col-size=\"sm\">$0<\/td>\n<td style=\"width: 11.6945%;\" data-start=\"1593\" data-end=\"1600\" data-col-size=\"sm\">High<\/td>\n<td style=\"width: 13.6038%;\" data-start=\"1600\" data-end=\"1607\" data-col-size=\"sm\">High<\/td>\n<td style=\"width: 11.0979%;\" data-start=\"1607\" data-end=\"1615\" data-col-size=\"sm\">High<\/td>\n<\/tr>\n<tr data-start=\"1616\" data-end=\"1704\">\n<td style=\"width: 10.9785%;\" data-start=\"1616\" data-end=\"1626\" data-col-size=\"sm\">FND-003<\/td>\n<td style=\"width: 26.7303%;\" data-start=\"1626\" data-end=\"1658\" data-col-size=\"sm\">3 months unreconciled account<\/td>\n<td style=\"width: 15.1551%;\" data-start=\"1658\" data-end=\"1668\" data-col-size=\"sm\">Finance<\/td>\n<td style=\"width: 9.06921%;\" data-start=\"1668\" data-end=\"1678\" data-col-size=\"sm\">$25,000<\/td>\n<td style=\"width: 11.6945%;\" data-start=\"1678\" data-end=\"1687\" data-col-size=\"sm\">Medium<\/td>\n<td style=\"width: 13.6038%;\" data-start=\"1687\" data-end=\"1694\" data-col-size=\"sm\">High<\/td>\n<td style=\"width: 11.0979%;\" data-start=\"1694\" data-end=\"1704\" data-col-size=\"sm\">Medium<\/td>\n<\/tr>\n<tr data-start=\"1705\" data-end=\"1776\">\n<td style=\"width: 10.9785%;\" data-start=\"1705\" data-end=\"1715\" data-col-size=\"sm\">FND-004<\/td>\n<td style=\"width: 26.7303%;\" data-start=\"1715\" data-end=\"1733\" data-col-size=\"sm\">No data backups<\/td>\n<td style=\"width: 15.1551%;\" data-start=\"1733\" data-end=\"1746\" data-col-size=\"sm\">Operations<\/td>\n<td style=\"width: 9.06921%;\" data-start=\"1746\" data-end=\"1751\" data-col-size=\"sm\">$0<\/td>\n<td style=\"width: 11.6945%;\" data-start=\"1751\" data-end=\"1760\" data-col-size=\"sm\">Medium<\/td>\n<td style=\"width: 13.6038%;\" data-start=\"1760\" data-end=\"1769\" data-col-size=\"sm\">Medium<\/td>\n<td style=\"width: 11.0979%;\" data-start=\"1769\" data-end=\"1776\" data-col-size=\"sm\">Low<\/td>\n<\/tr>\n<tr data-start=\"1777\" data-end=\"1856\">\n<td style=\"width: 10.9785%;\" data-start=\"1777\" data-end=\"1787\" data-col-size=\"sm\">FND-005<\/td>\n<td style=\"width: 26.7303%;\" data-start=\"1787\" data-end=\"1809\" data-col-size=\"sm\">Poor vendor vetting<\/td>\n<td style=\"width: 15.1551%;\" data-start=\"1809\" data-end=\"1823\" data-col-size=\"sm\">Procurement<\/td>\n<td style=\"width: 9.06921%;\" data-start=\"1823\" data-end=\"1832\" data-col-size=\"sm\">$5,000<\/td>\n<td style=\"width: 11.6945%;\" data-start=\"1832\" data-end=\"1839\" data-col-size=\"sm\">High<\/td>\n<td style=\"width: 13.6038%;\" data-start=\"1839\" data-end=\"1846\" data-col-size=\"sm\">High<\/td>\n<td style=\"width: 11.0979%;\" data-start=\"1846\" data-end=\"1856\" data-col-size=\"sm\">Medium<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div class=\"sticky end-(--thread-content-margin) h-0 self-end select-none\">\n<div class=\"absolute end-0 flex items-end\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<hr data-start=\"1858\" data-end=\"1861\" \/>\n<p data-start=\"1863\" data-end=\"2000\"><strong data-start=\"1863\" data-end=\"1897\">3. Practical Template in Excel<\/strong><br data-start=\"1897\" data-end=\"1900\" \/>To document this, Auren uses a <strong data-start=\"1931\" data-end=\"1969\">Materiality and Risk Rating Matrix<\/strong> in Excel. The columns include:<\/p>\n<ul data-start=\"2001\" data-end=\"2211\">\n<li data-start=\"2001\" data-end=\"2029\">\n<p data-start=\"2003\" data-end=\"2029\">Finding ID and Description<\/p>\n<\/li>\n<li data-start=\"2030\" data-end=\"2047\">\n<p data-start=\"2032\" data-end=\"2047\">Area\/Department<\/p>\n<\/li>\n<li data-start=\"2048\" data-end=\"2097\">\n<p data-start=\"2050\" data-end=\"2097\">Financial, Reputational, and Compliance Impacts<\/p>\n<\/li>\n<li data-start=\"2098\" data-end=\"2110\">\n<p data-start=\"2100\" data-end=\"2110\">Likelihood<\/p>\n<\/li>\n<li data-start=\"2111\" data-end=\"2149\">\n<p data-start=\"2113\" data-end=\"2149\">Materiality Rating (based on impact)<\/p>\n<\/li>\n<li data-start=\"2150\" data-end=\"2171\">\n<p data-start=\"2152\" data-end=\"2171\">Overall Risk Rating<\/p>\n<\/li>\n<li data-start=\"2172\" data-end=\"2190\">\n<p data-start=\"2174\" data-end=\"2190\">Auditor Comments<\/p>\n<\/li>\n<li data-start=\"2191\" data-end=\"2211\">\n<p data-start=\"2193\" data-end=\"2211\">Recommended Action<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2213\" data-end=\"2345\">Using drop-downs for impact and likelihood ensures standardization. Conditional formatting helps visually highlight high-risk areas.<\/p>\n<p data-start=\"2347\" data-end=\"2451\">You can <span class=\"\" data-state=\"closed\"><a class=\"cursor-pointer\" data-start=\"2355\" data-end=\"2450\">download the completed template here<\/a><\/span>.<\/p>\n<hr data-start=\"2453\" data-end=\"2456\" \/>\n<p data-start=\"2458\" data-end=\"2570\"><strong data-start=\"2458\" data-end=\"2489\">4. Application at ACME Corp<\/strong><br data-start=\"2489\" data-end=\"2492\" \/>Auren met with Aven and Liora to walk through each finding using the template:<\/p>\n<ul data-start=\"2572\" data-end=\"3691\">\n<li data-start=\"2572\" data-end=\"2957\">\n<p data-start=\"2574\" data-end=\"2957\"><strong data-start=\"2574\" data-end=\"2618\">High-Risk: FND-002 (Shared System Login)<\/strong><br data-start=\"2618\" data-end=\"2621\" \/>While there\u2019s no direct financial impact, the reputational and compliance risks are severe. Shared logins violated ACME\u2019s own policy and exposed sensitive systems to unauthorized access. Auren rated this finding \u201cHigh\u201d across all dimensions. Liora committed to enforcing individual logins and implementing multi-factor authentication.<\/p>\n<\/li>\n<li data-start=\"2959\" data-end=\"3259\">\n<p data-start=\"2961\" data-end=\"3259\"><strong data-start=\"2961\" data-end=\"3011\">High-Risk: FND-003 (Unreconciled Bank Account)<\/strong><br data-start=\"3011\" data-end=\"3014\" \/>With a $25,000 exposure and delayed reconciliation, this was also rated \u201cHigh.\u201d Auren highlighted the risk of fraud or error going unnoticed. The Finance team was tasked to complete reconciliations monthly and implement a cross-review process.<\/p>\n<\/li>\n<li data-start=\"3261\" data-end=\"3480\">\n<p data-start=\"3263\" data-end=\"3480\"><strong data-start=\"3263\" data-end=\"3312\">Medium Risk: FND-004 (Missing Backup Process)<\/strong><br data-start=\"3312\" data-end=\"3315\" \/>Although financial loss isn\u2019t immediate, the potential operational disruption is serious. The Operations Team agreed to implement an automated daily backup system.<\/p>\n<\/li>\n<li data-start=\"3482\" data-end=\"3691\">\n<p data-start=\"3484\" data-end=\"3691\"><strong data-start=\"3484\" data-end=\"3533\">Low Risk: FND-001 (Delayed Invoice Approvals)<\/strong><br data-start=\"3533\" data-end=\"3536\" \/>This was more of a process bottleneck with minor penalties, so it received a \u201cLow\u201d rating. Auren suggested using workflow automation tools for reminders.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3693\" data-end=\"3838\">The risk rating matrix empowered ACME to distinguish between nuisances and mission-critical issues, allowing smart allocation of time and budget.<\/p>\n<p>Upon reading the <a href=\"https:\/\/americanpro.org\/?page_id=105\">Disclaimer<\/a>, a reader may click the link below to download an example of a relevant tool:<\/p>\n<p><a href=\"https:\/\/americanpro.org\/wp-content\/uploads\/2020\/04\/TTs-Series-E-Internal-Audit-Evaluation-Conclusion-Techniques-Episode-07\u2014-Materiality-and-Risk-Rating.xlsx\">T&amp;Ts Series E, Internal Audit, Evaluation &amp; Conclusion Techniques, Episode 07\u2014 Materiality and Risk Rating<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction to the Tool\/TechniqueMateriality and Risk Rating is a critical evaluation method used in internal audit to determine the significance of audit findings. It supports prioritization by assigning ratings based on impact and likelihood. This allows stakeholders like CEOs and project leads to focus on the most pressing risks while ensuring compliance and performance [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":815,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[22],"tags":[],"class_list":["post-945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tt-internal-audit"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/e.americanpro.org\/wp-content\/uploads\/2025\/06\/Galaxy-6.gif","_links":{"self":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=945"}],"version-history":[{"count":0,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/945\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/media\/815"}],"wp:attachment":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}