How do you measure the performance of the Internal Audit function?

One metric stands out when it comes to assessing the performance of the CAE and his or her team: the satisfaction of their primary customer, the audit committee of the board. Second to that, and frankly not far apart in its effects on the longevity and mental health of the CAE, is the satisfaction of the CEO, CFO, and the rest of the executive team (but especially those two execs).

Having said that, there are other metrics that are very important.

ACI Learning has shared with us their suggestions in an article you can download.

Measuring the Performance of Internal Audit Departments: Standardize measurements and align business operations with balanced scorecards has some good points.

At the same time, I disagree with some and believe others are missed.

For example, the first metrics suggested are related to time:

• Audit announcement to when the final report is published (days)
• End of fieldwork to when the draft report is published (days)
• Publication of draft report to when the final report is published (days)
• Time variance Audit plan to actual (hours)
• Audit plan to actual (%)

As a CAE, I never measured any of these. I don’t think they are meaningful and may even lead practices in the wrong direction!

While some CAEs focus on publishing a report as soon as possible, my focus was on publishing the right, fair and balanced report that will help management and the board with actionable information, effecting the right change (if necessary) for the business.

My focus was on working with management to ensure they had the best systems, processes, organization, and controls to run the business, and to provide related assurance and insight to senior management and the board.

The next set of metrics are:

• Number of audits planned vs. completed (number)
• Number of audits planned vs. completed (%)

I don’t see either of these as a measure of effectiveness.

If you are using a continuously updated, enterprise risk-based audit plan, the number of audits planned is changing all the time. This is only relevant when you have a rigid audit plan (typically out-of-date before it is approved by the audit committee) and stubborn adherence to auditing what used to be a risk is considered important.

The authors don’t get to the most important metrics until page 5, when they talk about the customer. However, there is no assessment here of the satisfaction of the audit committee, not even of top management!

On the other hand, I like these:

• Training hours per auditor
• Management requests for audit services

There are other vital measures that are overlooked, such as:

• Satisfaction of the internal audit staff
• Career progression of the internal audit staff, including their being hired into management positions within the business
• Staff retention

As a CAE with several companies over many years, I had one set of questions. I asked it of members of the audit committee individually and as a group, as well as of the CEO, CFO, and their direct reports:

• How are we doing?
• Are we helping you with your job?
• What else can we do to help you?
• What should we stop doing?
• Do you have specific comments on what we are doing and on the members of the team?

I now ask you:

• How should you or anybody else assess the performance of internal audit?
• How am I doing with this blog?
• What changes should I make?