Audit Finding Severity Calculator

Adjusted severity = (0.25 × control importance + 0.20 × pervasiveness + 0.20 × exposure band + 0.20 × regulatory implication + 0.15 × recurrence) × compensating-control factor × repeat uplift. Pervasiveness and recurrence do most of the work in separating a one-off slip from a broken process, and a compensating control can only halve the severity because it was not designed for this risk and has not been tested against it. The repeat uplift exists because a finding that comes back is evidence about the management response, not just about the control.

Consistent finding ratings are what make an audit report actionable rather than negotiable, and the SLA and escalation route follow from the rating so that severity has consequences. These are management estimates to support consistency, not an auditor's formal opinion.

This calculator takes 7 inputs: Importance of the failed control, Pervasiveness, Financial or data exposure behind the finding, Regulatory or contractual implication, Likelihood of recurrence if untreated, Compensating control strength, Repeat of a previously reported finding. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because the failed control is no longer the only issue. Management previously accepted a remediation plan that did not work, which means either the root cause was misdiagnosed or the plan was never delivered — and both are governance findings that an audit committee should see.

They come from financial reporting, but the distinction travels well: is there a reasonable possibility that something important goes undetected, or is this a gap worth reporting but bounded? Use whatever terms your methodology defines, and apply the same thresholds every time.