Heads of Internal Audit Virtual Forum

08 February 2023

Please note:

• All Institute responses are boxed and highlighted in blue
• Where the chair comments in that capacity, the box is highlighted in yellow
• For confidentiality, the identities of all delegates/attendees are anonymised

Click here for the session slides summarising the examples.

• Typically, scorecards/KPIs are statistical with widespread use of client surveys, plan completion and training plan complete/budget used.
• Number of KPIs ranges from 4 up to 26 with the median being 14.
• Scorecards are between 1 and 4 pages in length.
• Good coverage of KPIs across the 4 Ps – people, plan, process, position.

David Hill – CEO, SWAP Internal Audit Services

• All KPIs going forward will be visual and automated using Power BI.
• More qualitative, less quantitative KPIs to ensure focus on value.
• Need to link to strategic risks, demonstrating we are risk-based, use an assurance map.
• Providing timely insights is important a potential measure could be about reducing time from identification of an issue to remediation also something around collaboration.
• Keen to demonstrate value add, so looking at KPIs on use of data analytics, money saving, control improvements and possibly removing obsolete controls.
• Think about efficiency of internal audit, time from planning to report issue, spend on technology.
• Be brave – provide information that the audit committee needs to know – discuss and build from a sound base.
• Measuring audit days is not useful, think instead about cost of audit delivery, it is a more transparent way of demonstrating value than cumulative audit days.
• Measuring ‘plan completion’ has a value but in context such as linkages to strategic risk, corporate governance, regulatory requirements etc.

• Check out David’s blog on modern metrics which covers seven areas of measurement.

• Do your KPIs tell the right story about your internal audit function?

Chat comments including Q&A

Comment | Introduced scorecard 7 years ago, has been an evolution. We provide an annual report to our Audit and Assurance Committee on Internal Audit (separate from our annual assurance opinion) which includes our KPIs / metrics etc. for the year, covering many of the items you have listed. We need to move to a more "continuous reporting" basis rather than just reporting on this once a year. We provide a progress report to our clients on a quarterly basis - I would like to be reporting some of our metrics within those reports eg relating to how much time it is taking to complete reviews (we have an issue at times with getting the level of engagement we would like when competing against other issues which may be perceived as more pressing)

Comment | Client surveys are a waste of time, tends to be people who’ve had a frustrating time on the audit and therefore complain, those who make comments knowing it will go to the board or those who are not really interested providing a meaningless couple of lines.

Comment | Link to strategy is important, demonstrating how internal audit has added value and provided assurance against strategic risks is key.

Comment | We are moving to a more agile "rolling" plan which looks ahead to the next 3- 6 months rather than a plan for the year so metrics like % of plan delivered are now less meaningful.

Comment | I only ever reported full completion of an audit plan once - which led to AC chair challenging the Exec for not doing anything risky over the period. [It wasn’t a criticism of internal audit but of the business not giving internal audit to cause to deviate from its planned assurance]

Question | What GRC system are teams using?

Responses

• AuditBoard; AuditBoard; Decision Focus