Aggregating Results Across Engagements
5 minutes
5 Questions
Aggregating results across engagements is the practice of consolidating findings, conclusions, and themes from multiple individual audit and assurance engagements to form an overall, enterprise-level view of governance, risk management, and control effectiveness. In the context of the Certification in Risk Management Assurance (CRMA) and risk-based audit planning, this process is critical because any single engagement provides only a narrow snapshot; it is the synthesis of results across the audit plan that allows internal audit to deliver meaningful insight to senior management and the board. The process begins at the planning stage. A risk-based audit plan is built from the organization's risk universe and strategic objectives, so each engagement is already mapped to specific risks, processes, or control objectives. When engagements are consistently scoped and rated using a common framework (e.g., COSO, ISO 31000) and standardized rating scales, their results become comparable and can be rolled up logically. During aggregation, auditors look for patterns such as recurring control deficiencies, systemic root causes (e.g., weak change management, inadequate segregation of duties, poor data governance), pervasive themes across business units, and trends over time. They also compare observed results against management's own risk assessments to evaluate the maturity and reliability of the organization's risk management framework—a core CRMA competency. The output is typically an annual or periodic overall opinion or thematic report that states whether risk management and controls are adequate and effective, highlights emerging or escalating risks, and identifies gaps in assurance coverage. These aggregated insights then feed back into the next cycle of risk-based planning, adjusting priorities, resource allocation, and audit frequency. Key challenges include ensuring consistency in judgment across teams, avoiding over-generalization from limited samples, reconciling conflicting results, and maintaining objectivity. Done well, aggregation elevates internal audit from a reporter of isolated issues to a strategic advisor that provides holistic assurance on enterprise risk.
Aggregating Results Across Engagements: A Complete Guide for the IIA CRMA Exam
Why Aggregating Results Across Engagements Matters
Individual audit or assurance engagements each tell a story about one process, business unit, or risk area. On their own, they are valuable, but they are also limited. A control weakness in procurement at one plant may look like an isolated issue. When the same weakness appears at four plants and in two shared-service centers, it is no longer a local problem; it is a systemic one that points to a design flaw in the control framework, a training gap, a cultural issue, or a weakness in governance oversight.
This is exactly why the Certification in Risk Management Assurance (CRMA) places weight on aggregating results across engagements. The CRMA is about providing assurance on the organization's risk management processes as a whole, and that requires internal audit and risk functions to step back from engagement-level findings and form an enterprise-level view. Boards and audit committees do not want a list of 200 findings; they want to know whether risk management and internal control are effective overall, where the themes and root causes lie, and whether the risk profile is improving or deteriorating.
Aggregation supports several key outcomes:
• It enables the Chief Audit Executive (CAE) to form and communicate an overall opinion on governance, risk management, and control, as encouraged by IIA Standards (including Standard 2450 on overall opinions in the 2017 International Standards and Domain IV of the Global Internal Audit Standards).
• It identifies systemic and root-cause issues that would otherwise be missed.
• It informs risk-based audit planning for subsequent periods, closing the loop between engagement results and future plans.
• It supports senior management and board decision-making by translating detailed results into themes, trends, and risk exposures.
• It helps evaluate the effectiveness of enterprise risk management (ERM) itself, because recurring control failures often indicate the risk management process is not identifying or responding to risks adequately.
What Aggregation of Results Actually Is
Aggregation is the systematic process of collecting, categorizing, analyzing, and synthesizing the results of multiple individual engagements (assurance, advisory, and follow-up) to produce conclusions at a higher level, such as a business unit, a risk category, a control objective, or the organization as a whole.
The key inputs typically include:
• Engagement conclusions and ratings (for example, satisfactory, needs improvement, unsatisfactory).
• Individual findings or observations, with their severity ratings and root causes.
• Management action plans and the status of remediation.
• Results of follow-up engagements and the age of open issues.
• Information from other assurance providers (second line functions such as compliance, risk management, quality, health and safety, and third-party assurance such as external audit), which is often integrated through combined assurance or assurance mapping.
• Key risk indicators, incidents, losses, and management self-assessments that provide context.
The outputs typically include:
• Themes and trends (for example, "access management controls are inconsistently applied across all regions").
• Root-cause analysis at the enterprise level (for example, inadequate policy, insufficient resources, weak tone at the top, poorly designed systems).
• An overall opinion or macro-level conclusion on the effectiveness of risk management and control.
• An assessment of the organization's risk profile compared with its risk appetite.
• Recommendations to the board and senior management for strategic or structural improvements.
• Inputs to the next risk-based audit plan.
How Aggregation Works in Practice
1. Establish a consistent framework before engagements begin. Aggregation only works if results are comparable. Internal audit functions therefore define, in advance, a common taxonomy of risk categories (strategic, operational, financial, compliance, IT, and so on), consistent control objectives (often mapped to a framework such as COSO Internal Control – Integrated Framework or COSO ERM), standardized rating scales for findings and engagements, and a defined list of root-cause categories. Without this consistency, summing up results produces noise rather than insight.
2. Capture results in a structured repository. Findings, ratings, root causes, affected entities, affected risks, and remediation status are recorded in an audit management system or database so they can be sorted, filtered, and analyzed. Each finding should be tagged to the universe of auditable entities and to the organization's risk register.
3. Analyze across dimensions. Typical analyses include:
• By risk category: Are findings concentrated in cyber, third-party, or regulatory risk?
• By control component: Are weaknesses mostly in the control environment, risk assessment, control activities, information and communication, or monitoring?
• By business unit or geography: Is one region consistently rated lower?
• By root cause: Are most issues caused by policy gaps, lack of training, system limitations, or management override?
• By trend over time: Are the number and severity of findings increasing or decreasing? Are the same issues recurring after being closed?
• By remediation status: How many high-risk issues are overdue, and does management repeatedly miss its own deadlines?
4. Apply professional judgment, not just arithmetic. Aggregation is not simply counting findings. Ten minor issues in a low-risk process are not equivalent to one critical issue in a key control over financial reporting or safety. Auditors weigh the significance, pervasiveness, and risk impact of findings, and consider mitigating factors and compensating controls. The CAE must also consider the scope and coverage of the engagements performed: an overall opinion can only be as strong as the breadth of the work supporting it. Where coverage is limited, the opinion must disclose that limitation.
5. Integrate with other assurance providers. Under the Three Lines Model, the second line (risk, compliance, and control functions) and external providers also generate results. An assurance map shows which risks are covered by whom and how reliably. Aggregating internal audit results with these other sources gives a more complete picture and helps avoid gaps and duplication. The CAE must assess the reliability and independence of other providers before relying on their work.
6. Form and communicate the overall conclusion. When issuing an overall opinion, the CAE should state the scope and time period, summarize the risk frameworks or criteria used, disclose any limitations, and clearly express the conclusion (for example, "generally satisfactory," "needs improvement," or "unsatisfactory"), supported by the key themes. Communication to the board and audit committee should emphasize what matters most: systemic risks, emerging risks, the direction of travel, and the adequacy of management's response.
7. Feed results back into planning. Aggregated results are one of the most important inputs to the risk-based audit plan. Areas with recurring or systemic weaknesses may warrant deeper or more frequent coverage, while areas with consistently strong results may allow reduced effort or reliance on other assurance providers. This creates a continuous cycle: plan, execute, aggregate, re-plan.
Common Challenges
• Inconsistent rating or taxonomy making results non-comparable.
• Limited coverage of the audit universe, which constrains the ability to opine at enterprise level.
• Over-reliance on counts of findings rather than their risk significance.
• Confirmation bias or pressure to present a more favorable picture to management.
• Stale data where results are aggregated only annually and miss emerging risks.
• Unreliable work of other assurance providers being aggregated without validation.
How to Answer Exam Questions on Aggregating Results Across Engagements
CRMA questions in this area tend to be scenario-based and test your judgment about the purpose, prerequisites, methods, and communication of aggregated results. Typical question patterns include: identifying the primary purpose of aggregation, selecting the most appropriate next step when a theme is identified across engagements, recognizing what is required before an overall opinion can be issued, and determining how aggregated results should be reported to the board.
Exam Tips: Answering Questions on Aggregating Results Across Engagements
Tip 1 – Think "enterprise view," not "engagement view." When a question asks why results are aggregated, the best answer usually relates to forming an overall conclusion on governance, risk management, and control, identifying systemic issues, or informing the board. Answers focused on a single engagement's remediation are usually distractors.
Tip 2 – Consistency comes first. If a question asks what must be in place for aggregation to be meaningful, look for answers about standardized rating scales, a common risk and control taxonomy, and a consistent methodology. The exam frequently rewards recognizing that comparable data is a precondition.
Tip 3 – Recurring findings signal root cause. When a scenario describes the same deficiency appearing in multiple business units, the correct response is typically to perform root-cause analysis and escalate the issue as a systemic or enterprise-level risk, rather than simply issuing separate recommendations to each unit.
Tip 4 – Risk significance beats raw numbers. Reject answer choices that rely on counting findings or averaging ratings mechanically. The CAE should weigh findings based on risk impact, pervasiveness, and the importance of the affected controls.
Tip 5 – Overall opinions require adequate coverage and disclosure. If a question involves issuing an overall or macro opinion, remember the Standards require the opinion to consider the strategies and risk appetite of the organization, be supported by sufficient, reliable, relevant, and useful information, and disclose the scope, period, limitations, and any reliance on other assurance providers. Answers that omit scope limitations or rely on incomplete coverage without disclosure are wrong.
Tip 6 – Validate before relying on others. When the scenario involves combining internal audit results with second-line or external assurance results, the correct answer typically involves assessing the competence, objectivity, and methodology of those providers before placing reliance on their work.
Tip 7 – Link aggregation to risk-based planning. Questions often test whether you understand that aggregated results feed the next audit plan. If asked how the CAE should use enterprise-level themes, look for answers about adjusting the risk assessment and audit plan, updating the audit universe, or reallocating resources toward higher-risk areas.
Tip 8 – Report themes, not lists, to the board. For questions about communicating aggregated results, favor answers that emphasize summarizing significant themes, trends, systemic root causes, the status of key remediation, and the overall conclusion in a concise, decision-useful way. Delivering every individual finding to the board is a classic distractor.
Tip 9 – Watch for independence and objectivity cues. If management pressures the CAE to soften an aggregated conclusion, the correct answer upholds the CAE's duty to report accurately and escalate to the board or audit committee as needed.
Tip 10 – Use the Standards' language. Phrases such as "overall opinion," "systemic issue," "root cause," "assurance map," "combined assurance," "sufficient, reliable, relevant, and useful information," and "risk appetite" are strong indicators of correct answers when they appear in context.
Worked Example
Scenario: During the year, internal audit completed 25 engagements. In 9 of them, auditors found that user access reviews were not performed on time. Each business unit has committed to a local action plan. The CAE is preparing the year-end report to the audit committee. What is the most appropriate action?
A. Report each of the 9 findings separately with their action plans.
B. Exclude the findings since management has already agreed to remediate them.
C. Identify the issue as a systemic weakness, analyze the root cause (for example, unclear policy ownership or inadequate tooling), and report it as an enterprise-level theme with a recommendation for a coordinated response.
D. Increase the number of access-related audits next year without further analysis.
Answer: C. The recurrence across 9 engagements indicates a systemic issue. The CAE should aggregate, analyze the root cause, and communicate it at the enterprise level. Option A misses the enterprise view, Option B ignores the governance significance, and Option D adjusts planning without first understanding the cause.
Key Takeaways
• Aggregating results turns engagement-level data into enterprise-level insight on the effectiveness of risk management and control.
• Consistency in taxonomy, rating scales, and methodology is the foundation of meaningful aggregation.
• Aggregation emphasizes risk significance, root causes, and trends rather than raw counts.
• Overall opinions must be supported by adequate coverage and clearly disclose scope and limitations.
• Aggregated results should be reported to the board as themes and conclusions and used to shape the next risk-based audit plan.
Master these principles and you will be well prepared for CRMA questions that test your ability to see the big picture across engagements.
Individual audit or assurance engagements each tell a story about one process, business unit, or risk area. On their own, they are valuable, but they are also limited. A control weakness in procurement at one plant may look like an isolated issue. When the same weakness appears at four plants and in two shared-service centers, it is no longer a local problem; it is a systemic one that points to a design flaw in the control framework, a training gap, a cultural issue, or a weakness in governance oversight.
This is exactly why the Certification in Risk Management Assurance (CRMA) places weight on aggregating results across engagements. The CRMA is about providing assurance on the organization's risk management processes as a whole, and that requires internal audit and risk functions to step back from engagement-level findings and form an enterprise-level view. Boards and audit committees do not want a list of 200 findings; they want to know whether risk management and internal control are effective overall, where the themes and root causes lie, and whether the risk profile is improving or deteriorating.
Aggregation supports several key outcomes:
• It enables the Chief Audit Executive (CAE) to form and communicate an overall opinion on governance, risk management, and control, as encouraged by IIA Standards (including Standard 2450 on overall opinions in the 2017 International Standards and Domain IV of the Global Internal Audit Standards).
• It identifies systemic and root-cause issues that would otherwise be missed.
• It informs risk-based audit planning for subsequent periods, closing the loop between engagement results and future plans.
• It supports senior management and board decision-making by translating detailed results into themes, trends, and risk exposures.
• It helps evaluate the effectiveness of enterprise risk management (ERM) itself, because recurring control failures often indicate the risk management process is not identifying or responding to risks adequately.
What Aggregation of Results Actually Is
Aggregation is the systematic process of collecting, categorizing, analyzing, and synthesizing the results of multiple individual engagements (assurance, advisory, and follow-up) to produce conclusions at a higher level, such as a business unit, a risk category, a control objective, or the organization as a whole.
The key inputs typically include:
• Engagement conclusions and ratings (for example, satisfactory, needs improvement, unsatisfactory).
• Individual findings or observations, with their severity ratings and root causes.
• Management action plans and the status of remediation.
• Results of follow-up engagements and the age of open issues.
• Information from other assurance providers (second line functions such as compliance, risk management, quality, health and safety, and third-party assurance such as external audit), which is often integrated through combined assurance or assurance mapping.
• Key risk indicators, incidents, losses, and management self-assessments that provide context.
The outputs typically include:
• Themes and trends (for example, "access management controls are inconsistently applied across all regions").
• Root-cause analysis at the enterprise level (for example, inadequate policy, insufficient resources, weak tone at the top, poorly designed systems).
• An overall opinion or macro-level conclusion on the effectiveness of risk management and control.
• An assessment of the organization's risk profile compared with its risk appetite.
• Recommendations to the board and senior management for strategic or structural improvements.
• Inputs to the next risk-based audit plan.
How Aggregation Works in Practice
1. Establish a consistent framework before engagements begin. Aggregation only works if results are comparable. Internal audit functions therefore define, in advance, a common taxonomy of risk categories (strategic, operational, financial, compliance, IT, and so on), consistent control objectives (often mapped to a framework such as COSO Internal Control – Integrated Framework or COSO ERM), standardized rating scales for findings and engagements, and a defined list of root-cause categories. Without this consistency, summing up results produces noise rather than insight.
2. Capture results in a structured repository. Findings, ratings, root causes, affected entities, affected risks, and remediation status are recorded in an audit management system or database so they can be sorted, filtered, and analyzed. Each finding should be tagged to the universe of auditable entities and to the organization's risk register.
3. Analyze across dimensions. Typical analyses include:
• By risk category: Are findings concentrated in cyber, third-party, or regulatory risk?
• By control component: Are weaknesses mostly in the control environment, risk assessment, control activities, information and communication, or monitoring?
• By business unit or geography: Is one region consistently rated lower?
• By root cause: Are most issues caused by policy gaps, lack of training, system limitations, or management override?
• By trend over time: Are the number and severity of findings increasing or decreasing? Are the same issues recurring after being closed?
• By remediation status: How many high-risk issues are overdue, and does management repeatedly miss its own deadlines?
4. Apply professional judgment, not just arithmetic. Aggregation is not simply counting findings. Ten minor issues in a low-risk process are not equivalent to one critical issue in a key control over financial reporting or safety. Auditors weigh the significance, pervasiveness, and risk impact of findings, and consider mitigating factors and compensating controls. The CAE must also consider the scope and coverage of the engagements performed: an overall opinion can only be as strong as the breadth of the work supporting it. Where coverage is limited, the opinion must disclose that limitation.
5. Integrate with other assurance providers. Under the Three Lines Model, the second line (risk, compliance, and control functions) and external providers also generate results. An assurance map shows which risks are covered by whom and how reliably. Aggregating internal audit results with these other sources gives a more complete picture and helps avoid gaps and duplication. The CAE must assess the reliability and independence of other providers before relying on their work.
6. Form and communicate the overall conclusion. When issuing an overall opinion, the CAE should state the scope and time period, summarize the risk frameworks or criteria used, disclose any limitations, and clearly express the conclusion (for example, "generally satisfactory," "needs improvement," or "unsatisfactory"), supported by the key themes. Communication to the board and audit committee should emphasize what matters most: systemic risks, emerging risks, the direction of travel, and the adequacy of management's response.
7. Feed results back into planning. Aggregated results are one of the most important inputs to the risk-based audit plan. Areas with recurring or systemic weaknesses may warrant deeper or more frequent coverage, while areas with consistently strong results may allow reduced effort or reliance on other assurance providers. This creates a continuous cycle: plan, execute, aggregate, re-plan.
Common Challenges
• Inconsistent rating or taxonomy making results non-comparable.
• Limited coverage of the audit universe, which constrains the ability to opine at enterprise level.
• Over-reliance on counts of findings rather than their risk significance.
• Confirmation bias or pressure to present a more favorable picture to management.
• Stale data where results are aggregated only annually and miss emerging risks.
• Unreliable work of other assurance providers being aggregated without validation.
How to Answer Exam Questions on Aggregating Results Across Engagements
CRMA questions in this area tend to be scenario-based and test your judgment about the purpose, prerequisites, methods, and communication of aggregated results. Typical question patterns include: identifying the primary purpose of aggregation, selecting the most appropriate next step when a theme is identified across engagements, recognizing what is required before an overall opinion can be issued, and determining how aggregated results should be reported to the board.
Exam Tips: Answering Questions on Aggregating Results Across Engagements
Tip 1 – Think "enterprise view," not "engagement view." When a question asks why results are aggregated, the best answer usually relates to forming an overall conclusion on governance, risk management, and control, identifying systemic issues, or informing the board. Answers focused on a single engagement's remediation are usually distractors.
Tip 2 – Consistency comes first. If a question asks what must be in place for aggregation to be meaningful, look for answers about standardized rating scales, a common risk and control taxonomy, and a consistent methodology. The exam frequently rewards recognizing that comparable data is a precondition.
Tip 3 – Recurring findings signal root cause. When a scenario describes the same deficiency appearing in multiple business units, the correct response is typically to perform root-cause analysis and escalate the issue as a systemic or enterprise-level risk, rather than simply issuing separate recommendations to each unit.
Tip 4 – Risk significance beats raw numbers. Reject answer choices that rely on counting findings or averaging ratings mechanically. The CAE should weigh findings based on risk impact, pervasiveness, and the importance of the affected controls.
Tip 5 – Overall opinions require adequate coverage and disclosure. If a question involves issuing an overall or macro opinion, remember the Standards require the opinion to consider the strategies and risk appetite of the organization, be supported by sufficient, reliable, relevant, and useful information, and disclose the scope, period, limitations, and any reliance on other assurance providers. Answers that omit scope limitations or rely on incomplete coverage without disclosure are wrong.
Tip 6 – Validate before relying on others. When the scenario involves combining internal audit results with second-line or external assurance results, the correct answer typically involves assessing the competence, objectivity, and methodology of those providers before placing reliance on their work.
Tip 7 – Link aggregation to risk-based planning. Questions often test whether you understand that aggregated results feed the next audit plan. If asked how the CAE should use enterprise-level themes, look for answers about adjusting the risk assessment and audit plan, updating the audit universe, or reallocating resources toward higher-risk areas.
Tip 8 – Report themes, not lists, to the board. For questions about communicating aggregated results, favor answers that emphasize summarizing significant themes, trends, systemic root causes, the status of key remediation, and the overall conclusion in a concise, decision-useful way. Delivering every individual finding to the board is a classic distractor.
Tip 9 – Watch for independence and objectivity cues. If management pressures the CAE to soften an aggregated conclusion, the correct answer upholds the CAE's duty to report accurately and escalate to the board or audit committee as needed.
Tip 10 – Use the Standards' language. Phrases such as "overall opinion," "systemic issue," "root cause," "assurance map," "combined assurance," "sufficient, reliable, relevant, and useful information," and "risk appetite" are strong indicators of correct answers when they appear in context.
Worked Example
Scenario: During the year, internal audit completed 25 engagements. In 9 of them, auditors found that user access reviews were not performed on time. Each business unit has committed to a local action plan. The CAE is preparing the year-end report to the audit committee. What is the most appropriate action?
A. Report each of the 9 findings separately with their action plans.
B. Exclude the findings since management has already agreed to remediate them.
C. Identify the issue as a systemic weakness, analyze the root cause (for example, unclear policy ownership or inadequate tooling), and report it as an enterprise-level theme with a recommendation for a coordinated response.
D. Increase the number of access-related audits next year without further analysis.
Answer: C. The recurrence across 9 engagements indicates a systemic issue. The CAE should aggregate, analyze the root cause, and communicate it at the enterprise level. Option A misses the enterprise view, Option B ignores the governance significance, and Option D adjusts planning without first understanding the cause.
Key Takeaways
• Aggregating results turns engagement-level data into enterprise-level insight on the effectiveness of risk management and control.
• Consistency in taxonomy, rating scales, and methodology is the foundation of meaningful aggregation.
• Aggregation emphasizes risk significance, root causes, and trends rather than raw counts.
• Overall opinions must be supported by adequate coverage and clearly disclose scope and limitations.
• Aggregated results should be reported to the board as themes and conclusions and used to shape the next risk-based audit plan.
Master these principles and you will be well prepared for CRMA questions that test your ability to see the big picture across engagements.
Test mode:
CRMA - Aggregating Results Across Engagements Example Questions
Test your knowledge of Aggregating Results Across Engagements
Question 1
During the year, eight assurance engagements in different business units each reported a moderate-rated finding. In every case, risk owners updated their risk registers but did not track whether agreed mitigation actions were completed or effective. Management closed most findings by updating the registers. The chief audit executive is now preparing the overall assessment of the organization's risk management processes. Which conclusion is BEST supported by these results?
Question 2
While compiling results for the annual overall opinion on risk management, a chief audit executive notes that ten of twelve engagements were rated satisfactory. The two unsatisfactory engagements covered the processes supporting the organization's two highest-rated strategic risks. Management's remediation plans for both are still in progress. A staff member proposes an overall satisfactory opinion because most engagements passed. Which approach BEST supports a sound overall conclusion?
Question 3
A chief audit executive is preparing an annual overall opinion on the organization's risk management processes. Five engagements in different business units were each rated satisfactory. However, each report included a minor finding that risk owners had not updated their risk assessments after significant operational changes. What should the chief audit executive do FIRST when aggregating these results?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2615 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Aggregating Results Across Engagements questions
19 questions (total)
Other Risk-Based Audit Planning and Engagements concepts
Audit Plan Approval and Resource CommunicationDeveloping Staff Through EngagementsDeveloping the Risk-Based Internal Audit PlanEngagement Objectives and Scope for Risk EngagementsEngagement SupervisionEngagement Work ProgramsEvaluating Management's Risk RemediationForming an Overall Assessment of Risk ManagementManagement Requests in the Audit PlanManaging Engagement Resources and TimelinesMarket and Industry Trends as Sources of RiskOrganizationwide Risk Assessment for Audit PlanningPrioritizing Engagements by RiskQuality Assurance in EngagementsRegulatory Change as a Source of RiskThe Audit UniverseUpdating the Audit Plan for Changing RisksUsing Management's Risk Assessment in PlanningUsing Other Providers' Work in an Overall Assessment