Internal Audit Editing and Proofreading Services

An internal audit finding is rated "high risk," and the same audit report rates a different, considerably less serious finding "medium risk" three pages later. A committee member reviewing both, with no idea what actually separates a high rating from a medium one in this audit team's practice, cannot tell whether the difference reflects a real gap in severity or simply which auditor happened to write up which finding, because the rating was applied without ever stating the criteria that produced it.

We edit what internal audit teams produce to rate and communicate finding severity — risk rating criteria and their consistent application, finding classification methodology documentation, audit committee reporting on rated findings, and the correspondence explaining why a specific finding received a specific rating. Our editors work on the word "high" and the criteria it is supposed to be standing in for.

The disclosed rating criteria is what a risk classification actually needs behind it, and its failure is a severity label applied without ever stating what threshold of likelihood, impact, or exposure actually separates one rating from the next. High risk, applied to a finding, tells a reader that the audit team judged it serious; it does not tell the reader what standard was used to reach that judgement, and two auditors on the same team, applying their own separate sense of what "high" means, can rate genuinely different levels of severity with the same word. We work through these so the rating criteria are stated once, specifically, and applied consistently — high: potential financial impact exceeding a stated threshold, or a control gap affecting a stated scope of transactions — rather than left as an undefined scale each auditor calibrates individually; so each specific finding states which criterion it met to receive its rating, given that a reader comparing a high-rated finding against the stated criteria can verify the rating was actually earned, rather than simply accepting a label; so a finding's likelihood and impact are assessed and stated separately before being combined into a single rating, because a low-likelihood, high-impact finding and a high-likelihood, low-impact one can arrive at the same overall rating through very different paths, and a committee needs to see which; so any change in a finding's rating from a prior audit cycle is explained, given that a control gap downgraded from high to medium with no stated reason invites the assumption that the downgrade reflects convenience rather than genuine improvement; and so a committee member's specific question about why one finding was rated differently from another receives a direct comparison against the stated criteria, not a repetition of the rating itself. Reports written this way mean a rating reflects a checked standard, not an individual auditor's unstated impression.

Everything you send is treated in confidence, including audit findings, risk assessments and committee correspondence. We are editors rather than internal auditors, risk assessors or audit committee members, and we offer no view on risk ratings, findings or audit methodology. What we can do is make sure the label states the criteria it is supposed to reflect.