Some internal auditors take the view that the internal audit profession should require that internal audit functions adopt a simple, yet sensible, grading or ranking of their engagement reports to better communicate their overall conclusions expressed in these reports. They propose that an overall rating be included in the audit report for each business unit or function audited. The purpose of the rating is to indicate the design adequacy and operating effectiveness of internal controls. For example, one proposed rating system is:
A. Controls are designed adequately and operating effectively to provide reasonable assurance that risks are being managed to an acceptable level.
B. Some opportunities for improvement were identified; generally, however, controls are designed adequately and operate effectively to provide reasonable assurance that risks are being managed to an acceptable level.
C. Significant opportunities for improvement were identified. Numerous specific control weaknesses were noted, resulting in areas where controls are unlikely to provide reasonable assurance that risks are being managed to an acceptable level.
D. Unsatisfactory. Controls are designed inadequately and/or operating ineffectively; therefore, there is no reasonable assurance that risks are being managed to an acceptable level. Present arguments for and against the use of internal audit ratings. Do you believe the use of ratings is appropriate or not? Explain your reasons.