Home > Risk > How do you measure the performance of the Internal Audit function?

How do you measure the performance of the Internal Audit function?

One metric stands out when it comes to assessing the performance of the CAE and his or her team: the satisfaction of their primary customer, the audit committee of the board. Second to that, and frankly not far apart in its effects on the longevity and mental health of the CAE, is the satisfaction of the CEO, CFO, and the rest of the executive team (but especially those two execs).

Having said that, there are other metrics that are very important.

ACI Learning has shared with us their suggestions in an article you can download.

Measuring the Performance of Internal Audit Departments: Standardize measurements and align business operations with balanced scorecards has some good points.

At the same time, I disagree with some and believe others are missed.

For example, the first metrics suggested are related to time:

  • Audit announcement to when the final report is published (days)
  • End of fieldwork to when the draft report is published (days)
  • Publication of draft report to when the final report is published (days)
  • Time variance Audit plan to actual (hours)
  • Audit plan to actual (%)

As a CAE, I never measured any of these. I don’t think they are meaningful and may even lead practices in the wrong direction!

While some CAEs focus on publishing a report as soon as possible, my focus was on publishing the right, fair and balanced report that will help management and the board with actionable information, effecting the right change (if necessary) for the business.

My focus was on working with management to ensure they had the best systems, processes, organization, and controls to run the business, and to provide related assurance and insight to senior management and the board.

The next set of metrics are:

  • Number of audits planned vs. completed (number)
  • Number of audits planned vs. completed (%)

I don’t see either of these as a measure of effectiveness.

If you are using a continuously updated, enterprise risk-based audit plan, the number of audits planned is changing all the time. This is only relevant when you have a rigid audit plan (typically out-of-date before it is approved by the audit committee) and stubborn adherence to auditing what used to be a risk is considered important.

The authors don’t get to the most important metrics until page 5, when they talk about the customer. However, there is no assessment here of the satisfaction of the audit committee, not even of top management!

On the other hand, I like these:

  • Training hours per auditor
  • Management requests for audit services

There are other vital measures that are overlooked, such as:

  • Satisfaction of the internal audit staff
  • Career progression of the internal audit staff, including their being hired into management positions within the business
  • Staff retention

As a CAE with several companies over many years, I had one set of questions. I asked it of members of the audit committee individually and as a group, as well as of the CEO, CFO, and their direct reports:

  • How are we doing?
  • Are we helping you with your job?
  • What else can we do to help you?
  • What should we stop doing?
  • Do you have specific comments on what we are doing and on the members of the team?

I now ask you:

  • How should you or anybody else assess the performance of internal audit?
  • How am I doing with this blog?
  • What changes should I make?
  1. Anonymous
    April 29, 2022 at 6:45 AM

    Very good advice!

  2. April 29, 2022 at 7:19 AM

    Norman,
    Your articles are always very insightful…steering IA in the correct directions.

  3. Silvana
    April 29, 2022 at 9:09 AM

    Very interesting. Thanks for your sharing.

  4. Judy M Beeson
    April 29, 2022 at 1:09 PM

    Thank you for your comments time measurement – it always seemed like we spent valuable time measuring and critiquing time rather than focusing spent on value add tasks and developing the efficiency and effectiveness of the team.

  5. Min On Lee
    April 29, 2022 at 6:30 PM

    There is no one size fits all in the assessment or appraisal of the IA function. Whilst some may not emphasise time measurement in completion of audit assignments and reporting, there are others who focus on this metric. More importantly, in relation to a listed entity, it is important for those charged with governance (for example the Audit Committee and Board of Directors) to receive assurance from the risk managers and the head of internal audit concerning the adequacy and operating effectiveness of the organisation’s system of governance, risk and internal controls, because the Board is required to provide a statement on this in the organisation’s annual report. Imagine if there are protracted delays by the IA for various reasons in completing the scope of work (as planned), being the extent deemed sufficient to provide such assurance to the Board, the process for reporting by the Board to shareholders will invariably be impacted. As such, the timeliness and extent of completion of IA plan become imperative in the evaluation metrics. Of course there are other scenarios involved and given that, any deviations from timeliness must be expeditiously explained in the appraisal for check and balance and fairness.

  6. brucemccuaig1
    April 30, 2022 at 3:17 AM

    Norman this is a great question. I think the IA department should be measured against the IA Mission statement which is “To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight”. Metrics may be tough to find initially bur certainly surveys of customers to score IA on assurance quality, value added etc should be useful if supported by examples from customers. IA could be force ranked against other corporate departments in terms of perceived value. I think another measure would be the proportion of audit time spent on value adding activities and the perceived impact of audit on achieving reliable performance (thereby increasing share price multiple).

  7. Anonymous
    May 2, 2022 at 2:33 PM

    Thanks Norman for giving us these great insights!

  1. April 29, 2022 at 6:51 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: