Better KPIs for Internal Audit
A blog by our EQA review team | 11 September 2017
Why do we find it so difficult to measure the performance of internal audit? EQAs frequently report that key performance indicators (KPIs) are narrow and focussed on simple execution-based metrics, generally relating to completion of the audit plan within budget. So what should be on a ‘balanced scorecard’ for internal audit?
The starting point really shouldn’t be the measures themselves. Start by focussing on your key stakeholders, your mandate, and your strategy to deliver that mandate. These will vary depending on the industry in which you operate, the geographical spread, the size of your organisation and the maturity of the internal audit function. This will give you the foundation on which to build both the KPIs and the management information to help you run the function.
Remember that KPIs should be ‘key’ – this means those factors relevant for delivering your strategy. Each organisation will differ, but there are likely to be indicators relating to operational efficiency, finance, staff capacity, capability and engagement, stakeholder engagement, and audit quality. Keep the number to something which can comfortably be reviewed (including trends) on one page – if you have more than 20 KPIs, challenge yourselves to consider whether each is key.
You can’t always directly measure things which are important but will need to find an alternative, recognising that it is not perfect. The frequency of KPIs may vary significantly; employee engagement scores may be annual whereas the number of audits completed can be updated weekly. Some KPIs, for example, should be forward looking – so you can identify future projects being squeezed through under resource constraints.
KPIs should be a valuable way to measure the performance of internal audit and facilitate continuous improvement. However, they are never perfect and can lead to unintended consequences if people, particularly leaders, don’t consider the bigger picture. The concept of a balanced scorecard means there will be a trade-off between different KPIs which may not be identified early enough; for example, a reduction in the number of days per audit may be accompanied by a reduction in audit quality which may not be identified until many months later. This can be avoided, but care should be taken in identifying how improvements are made.
Finally, don’t be tempted to ‘blame the data’. The data may not be perfect, but spend your energy on understanding why there are adverse variances and address the root causes. This is one of the ways to use KPIs to achieve excellence in internal audit.
Further reading
Internal audit performance measurement
Measuring internal audit effectiveness and efficiency
