Severity ratings without inflating the story

Severity is where deficiency logging earns trust — or loses it. Call everything significant and management stops listening. Soften every break and the audit committee is surprised later.

Questions we ask before rating

1. Could the break reasonably allow a material misstatement to go undetected?
2. Is the control compensating elsewhere in the same cycle?
3. Has the same condition already been raised by the external auditor?
4. Is the issue design (control missing) or operating (control exists but skipped)?

Examples from recent files

An unreconciled suspense balance that rolls for three months with no owner usually rates as significant. A clerk who occasionally initials a petty-cash count late, with no pattern of loss, is more often a lesser weakness with a training note.

Talking with process owners

We share draft ratings before the register is final. Owners may disagree; we document their view in the comments column and keep our rating if the evidence still supports it. The goal is a file that an external auditor can follow without decoding diplomacy.