Internal Audit

2. 2

3. 3
Table of Contents
INTERNAL AUDIT RATINGS GUIDE: SAMPLE 1.....................................................................................................4
INTERNAL AUDIT RATINGS GUIDE: SAMPLE 2.....................................................................................................8

4. 4
INTERNAL AUDIT RATINGS GUIDE: SAMPLE 1
(Insert Year) Remote Access Audit Month XX, (Insert Year)
(Audit Name) (Insert Date)
Instructions: Circle the audit rating determined through the completion of the audit rating grid on Page 4.
GOOD
Areas given a “Good” rating are well-controlled in every respect and demonstrate quality performance in almost
every aspect. Performance is above average and adequately provides for the safe and sound operation of the
area audited. Findings noted are minor; are not indicative of any significant weaknesses in policies, practices or
procedures; and are generally corrected in the normal course of business.
SATISFACTORY
Areas given a “Satisfactory” opinion have acceptable internal controls and demonstrate adequate performance in
most respects. Policies, practices and procedures are generally effective but may reflect modest weaknesses that
are readily correctable in the normal course of business. Commitment to internal control and operating efficiency
are acceptable. Some problems of relative significance may exist, but none are considered material.
REQUIRES IMPROVEMENT
Areas given a “Requires Improvement” opinion exhibit weaknesses within the internal control systems or the
absence of internal control surrounding significant activities. Additionally, these areas demonstrate performance
that is not adequately monitored and/or supervised by management, nor are policies and procedures always
effective to promote a climate where internal control concepts may be realized. Commitment to internal control
and/or operating efficiency needs enhancement.
UNSATISFACTORY
Areas given an “Unsatisfactory” opinion display performance or conditions that exhibit significant control
weaknesses throughout the areas included in the audit scope. In these areas, many basic internal control
concepts are not in effect and internal control systems are weak to the extent that significant financial losses or
violations of law or regulation could occur or may have occurred. The lack of policies and procedures or
adherence to them will prevent the accomplishment of a substantial part of the area’s objectives. Corrective action
must be immediately implemented with periodic (e.g., monthly) status reports routed to the area’s executive
management.
CONCURRENCE/NONCONCURRENCE
This rating applies to systems development and business or control projects in the process. It conveys
agreement/disagreement with a course of action or documents an opposing point of view. In each case, the report
will state whether audit believes the project should be aborted, or what actions should be taken prior to
commencing the next phase.
NOT RATED
The conditions or purposes of the audit do not require a rating to be assigned.
AUDIT RATING STANDARDS

5. 5
Instructions: Circle the point value assigned to each area. Multiply the point value by the factor for the applicable
area and write the value in the applicable column under “Score” and by the letter for the particular column. Add
the total points for each area across to obtain the overall point value. Use the overall point value to assign the
rating.
Internal Controls Operations Accounting Records
Factor Five
(From Page Three)
Factor Three
(From Page Four)
Factor Two
(From Page Five)
Points Score Points Score Points Score
5 5 5
4 4 4
3 3 3
2 2 2
1 1 1
Total A20 Total B12 Total C
Total Score: XX
Check the appropriate rating based on the total score.
Good 50-39 points
Satisfactory 38-25 points
Requires Improvement 24-15 points
Unsatisfactory 14 and below
Additional rating factors for audits to be rated “Good” include:
• Major system changes or upgrades during the audit period
• Significant changes in personnel during the audit period
• Significant new products or services introduced during the audit period
• Uncorrected internal/external audit or examination findings
• Unaccepted internal audit recommendations
AUDIT RATING GRID
RATING SCALE

6. 6
INTERNAL CONTROLS
Rating summary of internal control structure:
• 5: Virtually all desired controls are in place and operating. Only very minor exceptions were noted, and backup
controls exist for all weaknesses noted.
• 4: Most material controls are in operation and the exposures found are minor in extent and nature. They are
usually backed up by other controls.
• 3: Attention should be given to some exposures in protective and detective controls. Reasonable assurance
exists that current controls afford the bank adequate protection.
• 2: Early attention should be given to exposures in protective and detective controls. Deterioration in current
controls can lead to serious exposures.
• 1: Immediate attention to serious exposures in protective and detective controls is required. Exposures exist
that could make the bank vulnerable to significant losses.
Support for rating of internal control structure: (List)
All of management’s controls were sufficiently designed to mitigate risks and achieve control objectives related to
remote access. Additionally, all of management’s controls were tested for operating effectively to mitigate the
intended risks and achieve the intended control objectives.
OPERATIONS
Prepare the following rating based on audit evidence.
Rating Summary of Operations
5 Performance is significantly higher than average.
4 Performance is above average.
3 Performance is average.
2 Performance is below average.
1 Performance is unacceptable.
Support for rating of operations: (List)
Internal audit’s testing revealed that management possessed documented policies and procedures in all relevant
and significant areas related to remote access (specifically the remote administration of IT systems, encryption
and passwords).
Through discussions with IT management and a walk-through of the controls, internal audit also determined that
IT management personnel responsible for performing or monitoring the controls were knowledgeable of the
controls and had many years of experience in working in their related fields.
Internal audit identified the following opportunities to further enhance and improve existing controls, but these
improvements did not constitute control failures because of numerous compensating controls that adequately
reduce risk to the bank.
• IT management should reassess the need for the modem remote access system.
COMPOSITE RATING AREAS

7. 7
• Management should update its remote administration of IT’s systems policy and annual privileged account
review procedure to require the annual review of all accounts with access to perform remote administration of
IT systems.
See VIII. Remote Access Recommendation Memo.doc for additional information regarding these
recommendations.
ACCOUNTING RECORDS
Rating Summary of Operations
5 The books and records more than adequately and accurately reflect transactions.
4 The books and records adequately and accurately reflect transactions.
3 The books and records, in reasonable detail, accurately reflect transactions.
2 The books and records less than adequately reflect transactions.
1 The books and records do not accurately reflect transactions.
Support for the rating of accounting records: (List)
There are no financial books or records applicable to the remote access audit. There are some IT records
applicable to the audit and they include remote access activity reports and IT service requests. Remote access
activity reports are used by management to monitor who is using the remote access system and to detect any
inappropriate use of the remote access system. IT service requests record the approval and testing of any
changes to remote access systems (including system and access changes). Internal audit noted that these IT
records adequately and accurately reflect system and access changes related to remote access.

8. 8
INTERNAL AUDIT RATINGS GUIDE: SAMPLE 2
AUDIT RATING DEFINITIONS
Rating Definition
Strong
Internal control systems are sufficiently comprehensive and appropriate to the size and
complexity of the organization. Risks are effectively managed. Monetary risk
associated with potential control failures is not material. A few exceptions to
established policies and procedures were identified.
Satisfactory
While there may be some minor risk management weaknesses, these issues have
been recognized and are being addressed. Risks are effectively managed. Internal
control systems may display modest weaknesses or deficiencies, but they are
correctable in the normal course of business.
Needs Improvement
Risk management practices are lacking in important ways and are a cause for more
than supervisory attention. Risks may not be effectively managed. Weaknesses may
include control exceptions or failures that could have adverse effects on the
organization if corrective actions are not taken.
Needs Significant
Improvement
Marginal risk management practices generally fail to identify, monitor and control
significant risk exposures in many material respects. The organization may have
serious identified weaknesses that require substantial improvement in internal controls
or procedures. Risks are not effectively managed. Unless properly addressed, these
conditions may result in a significant impact on the organization.
Unsatisfactory
Due to the absence of effective risk management practices, management is unable to
identify, monitor or control significant risk exposure. Internal control systems may be
sufficiently weak to jeopardize the continued viability of the organization. Risks are not
effectively managed. Deficiencies in risk management procedures and internal controls
require immediate and close supervisory attention.
AUDIT REPORT RATING MATRIX
Rating Scale Definition
Effective
1
• Overall risk program is reliable and requires negligible improvements.
• The risk management procedures are formalized and documented and
communicated and understood throughout the business. Risk
management system is robust and possesses the capacity and ability to
consistently identify, document and assess existing and emerging risks.
• Risk controls effectively manage, mitigate, and transfer existing and
foreseeable risks and do not expose the business to undue risk. Risk
program does not expose the business to unwarranted financial loss or
regulatory noncompliance. Audit recommendations are generally
housekeeping in nature.
2

9. 9
Rating Scale Definition
Monitor
3
• Overall risk program is adequate for the current level of risk within the
business but requires ongoing monitoring.
• The risk management procedures are formalized and documented but
not communicated. Risk procedures need to be communicated and
business needs to obtain assurance that procedures are understood.
Although the risk management system possesses the capacity and
ability to identify, document and assess existing risk, specific
improvements are needed to ensure accurate and timely incorporation
of emerging risks.
• Risk controls adequately manage, mitigate, and transfer existing risks
but improvements are required as emerging risks and changing
conditions could lead to a weakened risk management capacity. The risk
program does not expose the business to immediate financial loss or
regulatory noncompliance. The director must make improvements within
60 days.
4
Needs Improvement
5
• Overall risk program is not adequate.
• The risk management procedures are partially formalized and
documented and not communicated. Risk procedures require
improvement to assure that risk processes are fully documented and
need to be clearly communicated. The business unit needs to obtain
assurance that the risk process is understood.
• Risk management systems require improvement to ensure reliability of
procedures to accurately, and in a timely manner, identify, document,
and assess existing and new risks. Controls require improvement to
ensure the ability of mechanisms to manage, mitigate, and transfer
existing and emerging risks as changing conditions will possibly lead to
a weakened risk management capacity. The line of business, without
improvements, is likely to be vulnerable to financial loss or regulatory
noncompliance. Improvements are required within the next 30 to 60
days.
6
Impaired
7
• Overall risk program is impaired.
• The risk management procedures are informal and undocumented and
not communicated for the most part. Risk procedures require
improvement to assure that risk processes are fully and accurately
documented and must be communicated and understood by the
business.
• Risk management systems require significant improvement to ensure
reliability of procedures to accurately and in a timely manner identify,
document, and assess existing and new risks. Controls require
extensive improvements to secure the ability to manage, mitigate, and
transfer existing and emerging risks, as conditions will lead to a
weakened risk management capacity. Risk program exposes the
business to potential financial loss or regulatory noncompliance.
Improvements are needed within the next 30 days.
8

10. 10
Rating Scale Definition
Unsatisfactory
9
• Overall risk program is not acceptable.
• The risk management procedures are largely nonexistent,
undocumented and not communicated. Risk procedures must be
instituted, formalized, documented and communicated.
• Risk management systems must be implemented immediately to
accurately and in a timely manner identify, document, and assess
existing and new risks.
• Implementation of control mechanisms is required to manage, mitigate
and transfer risks present in business processes and possess flexibility
to react under changing conditions. The line of business is exposed to
material financial loss or regulatory noncompliance. Improvements are
needed within the next two weeks and the audit committee must be
made aware of improvements to be implemented.
10
AUDIT REPORT RATING GUIDELINES
Rating Scale Definition
Effective
1
• No high-risk issues
• No medium-risk issues
• No more than three low-risk issues
2
• No high-risk issues
• No more than one medium-risk issue
• No more than six low-risk issues
Monitor
3
• No high-risk issues
• No more than three medium-risk issues
• No more than four low-risk issues
or
• No high or medium-risk issues and more than six low-risk issues
4
• No high-risk issues
• No more than four medium-risk issues
• No more than six low-risk issues
Needs
Improvement
5
• No more than one high-risk issue
• No more than four medium-risk issues
or
• No high-risk issues and no more than six medium-risk issues
6
• No more than two high-risk issue
• No more than six medium-risk issues
or

11. 11
Rating Scale Definition
• No more than one high-risk issue and more than six medium-risk issues
Impaired
7
• No more than three high-risk issues
• No more than four medium-risk issues
8
• No more than three high-risk issues
• No more than six medium-risk issues
Unsatisfactory
9
• More than four high-risk issues
• More than six medium-risk issues
or
• No more than two high-risk issues and more than six medium-risk issues
10
• No more than four high-risk issues
• No more than six medium-risk issues
XYZ AUDIT RATINGS
ST Strong
The audited area meets or exceeds Company X standards in all critical respects. Level
of internal controls is functioning effectively and efficiently. Information systems and
user operations are integrated and support the business. Generally, no more than two
“Low” observations were noted.
SA Satisfactory
The audited area meets the overall Company X standards. Generally, no more than two
“Important” observations may exist that are being promptly addressed by management.
A few “Notable” observations may also exist.
N
Needs
improvement
The audited area does not meet Company X standards overall. Generally, there is
either at least one “High” observation and/or at least three “Important” observations,
which if uncorrected could expose Company X to an unacceptable risk.
U Unsatisfactory
The audited area contains unacceptable gaps in the overall control structure and/or
controls are not working as intended. Generally, there are at least one “High”
observation and/or five “Important” observations. The area requires immediate attention
with oversight by senior management.
Business Importance Codes
H High
Risk involves a substantial and direct exposure to loss of assets and/or misstatement of
financial information and/or loss of revenue and/or significant negative impact on
operating effectiveness and/or the company’s reputation. High likelihood and high impact
may occur.
I Important Risk involves an unacceptable and direct exposure to loss of assets and or misstatement
of financial information and/or loss of revenue and/or negative impact on operating

12. 12
effectiveness and/or the company’s reputation. Moderate likelihood and moderate to
high impact or high likelihood and moderate impact may occur.
N Notable
Risk involves an important but indirect and limited level exposure to loss of assets and/or
loss of revenue and/or negative impact on operating effectiveness and/or the company’s
reputation, which is outside of Company X’s risk appetite. Low likelihood and moderate
to high impact or moderate likelihood and moderate to low impact may occur. This also
includes low-impact/high-likelihood observations.
L Low
Generally, issues classified in this category are brought to management’s attention as an
efficiency improvement. Low likelihood and low to moderate impact or low to moderate
likelihood and low impact may occur.
Note: Each audit report observation is assigned a priority rating to establish its level of criticality. The
ratings are assigned collaboratively by internal audit and XYZ Company management responsible for the
process being audited.
Overall Classifications: COSO
F Financial Reporting Reliability of the financial reporting process
O Operational Operational effectiveness and efficiency
C Compliance Compliance with applicable laws and regulations
S Strategic High-level goals aligned with and supporting the mission of XYZ Company
INTERNAL CONTROL OPTION CRITERIA
Based on the results of the audit, the system of internal controls will be rated as “Strong,” “Satisfactory,”
“Unsatisfactory” or “Critical” based on the following criteria:
Rating Definition
Strong Satisfactory Unsatisfactory Critical
• Issues do not exist. • Issues are not likely to
impair business
operations or
jeopardize financial
integrity.
• Significant issues
exist.
• Corrections are
required to avoid or
contain exposure.
• Prompt action is
required.
• Significant issues
find/indicate
processes/results are
unreliable.
• Impact of weaknesses
is likely widespread/
compounding.
• Immediate attention is
required.

13. 13
Attributes of Control Environment
Strong Satisfactory Unsatisfactory Critical
• Control
processes/monitoring
are effective.
• Control
processes/monitoring
are effective for key
cycles/functions.
• Control
processes/monitoring
weaknesses/are not
effective.
• Control monitoring is
not in place or is
extremely unreliable.
• Low potential for
undetected errors and
omissions exists.
• Major issues would
likely be detected.
• Major issues may not
be detected and
corrected.
• Losses/undetected
errors and omissions
are likely.
• Company policy and
GAAP are adhered to.
• Policy and GAAP
compliance issues
have no material
impact on operations
or financial
statements.
• Policy or GAAP
noncompliance could
(or does) have a
material impact on
operations/financials.
• Policy or GAAP
noncompliance issues
are severe, pervasive
and material to
operations/financials.
• Financials/results are
reliable; therefore,
adjustments are not
necessary.
• Financial adjustments,
if any, are minor.
• Material financial
adjustments may be
required.
• Financials/results are
likely unreliable. Major
problems exist.
• Regulatory
compliance issues do
not exist.
• Regulatory
compliance issues, if
any, are minor and
isolated.
• Regulatory
compliance issues
may show signs of
being systemic.
• Compliance issues are
significant and carry
severe consequences
(fines, sanctions, etc.).
• Risk to the CBI image
is nonexistent.
• Issues carry low-level
(or no) risk to the CBI
image.
• Issues may carry
potential for damage
to the CBI image.
• Issues may carry
severe risk of damage
to the CBI image.
• Ethics issues do not
exist.
• Ethics issues, if any,
are minor and
management takes
timely, appropriate
corrective actions.
• Ethics issues are not
appropriately
addressed and/or
management does not
set the appropriate
tone.
• Ethics issues are not
addressed
appropriately and/or
management does not
set the appropriate
tone.
AUDIT RATING EXAMPLE
Audit Ratings Are Assigned Based on the Following Definitions
Rating Definition
Satisfactory
The audited area has effectively assessed its risks; implemented control processes; and
complied with applicable policies, procedures, and appropriate laws and regulations. We may
have noted a few inconsistencies, but compensating controls exist that sufficiently minimize
the risk of loss.
Generally
Satisfactory
The audited area has adequately assessed its risks and has implemented generally effective
control processes. We may have noted some weaknesses in controls, but they are not such
that the audited area is significantly exposed to the risk of loss. Such audited areas are in

14. 14
Rating Definition
general compliance with applicable policies, procedures, and appropriate laws and
regulations.
Marginal
The audited area has control, policy, procedural, compliance and/or repeat findings that are
sufficiently important to warrant the attention of more senior levels of management. Any
deterioration in the current operating routine could lead to serious exposures and regulatory
criticisms.
Unsatisfactory
The audited area has serious control, policy, procedural, compliance and/or repeat findings.
Losses may not yet be realized, but exposure to potentially serious loss may exist. Exposure
may also exist to potentially serious criticism by regulators. Such situations require urgent
action and senior management involvement in implementing corrective action.
Unrated
This rating is generally reserved for first-time audits, limited scope audits and special
projects.

15. 15
APPENDIX A: DEFINITION OF INTERNAL AUDIT RATINGS AND RANKINGS
Definition of Issue Rankings
Adequate Needs Improvement Inadequate
• There are no identified issues
that have either a “Medium” or
“High” ranking.
• There may be a limited number
of issues with a “Low” ranking
and/or other observations for
potential improvement.
• There are one or more identified
issues with either a “Medium” or
“High” ranking.
• A deficiency or combination of
deficiencies impact the design
and/or operating effectiveness
of control for the area under
review to the extent that
required control objectives may
not be consistently achieved.
• The deficiency or combination
of deficiencies impacts the
company’s ability to provide
reasonable assurance over the
effective design and/or
operation of control, thus
affecting the company’s risk
exposure within the area being
reviewed.
• The deficiencies merit prompt
attention and remediation by
management to improve the
overall design and/or operating
effectiveness of control for the
area under review to meet
required control objectives.
• There are one or more identified
issues with either a “Medium” or
“High” ranking.
• A deficiency or combination of
deficiencies significantly impair
the design and/or operating
effectiveness of control for the
area under review to the extent
that required control objectives
may not be consistently
achieved.
• The deficiency or combination
of deficiencies significantly
impacts the company’s ability to
provide reasonable assurance
over the effective design and/or
operation of control, thus
affecting the company’s risk
exposure within the area being
reviewed.
• The deficiencies merit
immediate attention and
remediation by management to
improve the overall design
and/or operating effectiveness
of control for the area under
review to meet required control
objectives.
High
• The issue is a control deficiency, which represents a significant gap in the design
and/or operating effectiveness of the control affecting the company’s ability to address
relevant risks and to provide reasonable assurance regarding the achievement of
desired outcomes.
• The issue requires an immediate, comprehensive, corrective action plan with progress
to be monitored by an appropriate level of management.
Medium
• The issue is a control deficiency, which represents a gap in the design and/or
operating effectiveness of the control affecting the company’s ability to address
relevant risks and provide reasonable assurance regarding the achievement of desired
outcomes.
• The issue requires prompt attention to ensure that internal controls are designed
and/or operating effectively.
Low
• The issue represents an opportunity to improve control and processes to support the
achievement of desired outcomes.

16. 16
• The issue should be addressed promptly, as time and resources permit.
Considerable professional judgment is required in applying the ratings defined and used in this report regarding
individual findings, recommendations, and in formulating an overall conclusion. Accordingly, others could rate the
findings or conclusion differently and this should be born in mind when considering this report.

17. 17
APPENDIX B: RATING OF AUDIT FINDINGS
Rating
Categories
Risk/Impact Explanation
Need for Action and
Responsible Function
Reporting Obligations
Particularly
Severe (A)
Risks threatening the
existence of the
organization include:
• Fatal material losses
• Image loss/publicly
effective impact
(massive loss of
customers)
• Violation of regulatory
requirements (and
possible revoking of the
operating license)
• Urgent remediation by the
management board
required immediate
involvement of the
supervisory body
• Monitoring of timely
remediation by internal
audit (follow-up)
Refer to reporting obligations
for Major (C) and Severe (B)
findings, and:
• Immediate notification of
the supervisory body by
the management board
Severe (B) Critical risks for business
continuity include:
• Very high material
losses (losses are not
detected timely)
• Image loss/publicly
effective impact
(adversely affects the
image on the market)
• Violation of regulatory
requirements (and
possible criminal
liability, etc.)
• Immediate remediation by
the management board
required (immediate
involvement of the
supervisory body and the
supervisory authorities in
case of severe findings
against management
board members).
• Monitoring of timely
remediation by internal
audit (follow-up).
Refer to reporting obligations
for major findings (C) and:
• Immediate submission of
the internal audit report to
the management board
• Immediate notification of
the chairman of the
supervisory body and the
supervisory authorities by
the management board in
case of severe findings
against management
board members
• At least annual reporting
from the management
board to the supervisory
body (highlighted findings,
including remedy
measures taken and their
implementation statuses)

18. 18
Rating
Categories
Risk/Impact Explanation
Need for Action and
Responsible Function
Reporting Obligations
Major (C) High risks for business
continuity include:
• High material losses (if
weaknesses are not
remedied timely)
• Image loss (many
internal and external
parties are affected)
• Violation of regulatory
requirements (and
possible fines, etc.)
• Remediation required
close supervision by the
responsible member of
the management board
• Monitoring of timely
remediation by internal
audit (follow-up)
• Highlighted in the internal
audit report
• Included in the (annual)
overall internal audit report
to the management board
(including remedy
measures taken)
• Reported to the
supervisory body by the
management board at
least annually, if not
remedied
• If not remedied within an
appropriate period, the
responsible member of the
management board must
be informed in writing (If
the findings remain
unresolved during the
financial year, the
management board must
be informed in writing in
the next (annual) overall
internal audit report, at the
latest.)
Improvement
Opportunity
(D)
Medium risks for business
continuity include:
• Medium material
losses
• Image loss (internal,
some external parties
are affected, if
applicable)
• Noncompliance
with/implementation of
certain regulatory
requirements
• Implementation of certain
improvement measures
recommended
• Monitoring by the head of
the audited organization
unit (Immediate
involvement of the
management board is not
required.)
• Monitoring of timely
remediation by internal
audit (follow-up)
• Included in the internal
audit report
• Not included in the
(annual) overall internal
audit report
Comment (E) • Low or no risks
• "Food for thought" for
improvement/further
development
• Decision on the
prioritization and
implementation of
measures remains in the
audited organizational
unit.
• Monitoring by the head of
the audited organization
• Summarized in the internal
audit report or a separate
management
summary/memo
• Not included in the
(annual) overall internal
audit report

19. 19
Rating
Categories
Risk/Impact Explanation
Need for Action and
Responsible Function
Reporting Obligations
unit (Involvement of the
management board is not
required.)
• Not included in the follow-
up by internal audit