What criteria are used to classify audit findings by severity and priority?

• A. Severity relates to impact on safety, legality, or operation; priority relates to urgency of corrective action based on risk level and exposure.
• B. Severity relates to cost; priority relates to management preference.
• C. Severity relates to number of personnel affected; priority relates to department workload.
• D. Severity relates to time since occurrence; priority relates to whether it has a formal owner.

Answer: (A)

In audit findings, the main idea is to separate how serious a problem is from how urgently it must be fixed. Severity measures the potential impact on safety, legality, or ongoing operation—essentially, how bad the consequence would be if the finding isn’t addressed. Priority, on the other hand, reflects how urgently corrective action is needed, based on the overall risk level and the exposure involved. This distinction lets teams allocate resources wisely: a finding with high safety impact typically drives a high-priority action, while lower-severity issues may be scheduled with lower urgency. The provided criteria capture this relationship by tying severity to the magnitude of impact and priority to the urgency of remediation given the risk and exposure. Choices that focus solely on cost, preference, number of people affected, or timing/ownership don’t align with how audit findings are typically classified by risk and impact.