diff --git a/security_review.inc b/security_review.inc
index 2298f24..a2c40b4 100644
--- a/security_review.inc
+++ b/security_review.inc
@@ -205,6 +205,12 @@ function security_review_check_file_perms() {
   $file_path = './' . rtrim(variable_get('file_public_path', conf_path() . '/files'), '/');
   // Set files to ignore.
   $ignore = array('..', 'CVS', $file_path);
+  // Add private files directory if it's set.
+  $private_files = variable_get('file_private_path', '');
+  if (!empty($private_files)) {
+    $private_files = substr($private_files, strrpos($private_files, '/') + 1);
+    $ignore[] = $private_files;
+  }
   $files = _security_review_check_file_perms_scan('.', $ignore);
 
   // Try creating or appending files.
@@ -339,26 +345,21 @@ function security_review_check_error_reporting() {
  * There is ample room for the user to get around this check. @TODO get more sophisticated?
  */
 function security_review_check_private_files() {
-  // Get the default download method.
-  $scheme = variable_get('file_default_scheme', '');
-  // Most insecure configurations will be using the local private wrapper.
-  if ($scheme == 'private') {
-    $file_directory_path = variable_get('file_private_path', '');
-    if (strpos($file_directory_path, '/') === 0) {
-      // Path begins at root.
-      $result = TRUE;
-    }
-    elseif (strpos($file_directory_path, '../') === 0) {
-      // Path begins by moving up the system.
-      $result = FALSE;
-    }
-    else {
-      // Directory is relative (or crafty).
-      $result = FALSE;
-    }
+  $file_directory_path = variable_get('file_private_path', '');
+  if (empty($file_directory_path)) {
+    $result = NULL; // Ignore this check.
+  }
+  elseif (strpos($file_directory_path, '/') === 0) {
+    // Path begins at root.
+    $result = TRUE;
+  }
+  elseif (strpos($file_directory_path, '../') === 0) {
+    // Path begins by moving up the system.
+    $result = FALSE;
   }
   else {
-    $result = NULL;
+    // Directory is relative (or crafty).
+    $result = FALSE;
   }
   return array('result' => $result);
 }
diff --git a/tests/security_review.test b/tests/security_review.test
index c9cb1b0..398a7b2 100644
--- a/tests/security_review.test
+++ b/tests/security_review.test
@@ -92,6 +92,8 @@ class SecurityReviewTestCase extends DrupalWebTestCase {
       $this->assertTrue(is_array($return), "Check $name returns an array");
       $this->assertTrue(array_key_exists('result', $return), "Check $name has key 'result'");
     }
+    // Note, not all checks can be tested (such as file permission checks)
+    // because of the shared dependencies of simpletest with the host.
 
     // Test text formats check.
     $check = security_review_check_input_formats();
@@ -105,10 +107,6 @@ class SecurityReviewTestCase extends DrupalWebTestCase {
     $check = security_review_check_error_reporting();
     $this->assertFalse($check['result'], 'Error reporting check fails');
 
-    // Private files not enabled.
-    $check = security_review_check_private_files();
-    $this->assertTrue(is_null($check['result']), 'Private files check is null');
-
     // Failed logins is null.
     $check = security_review_check_failed_logins();
     $this->assertTrue(is_null($check['result']), 'Failed logins check is null');