MEASURING INTERNAL AUDIT

PERFORMANCE - WHAT ARE THE

IMPORTANT METRICS?

Measuring Internal Audit Performance -

WeiserMazars LLP’s Governance, Risk and Compliance
(GRC) Group

WeiserMazars LLP is an independent member firm of Mazars Group.

GRC

BACKGROUND included in the audit charter and/or mission statement of IA

In today’s environment of increased regulation and focus functions.
on governance and risk management, the true “value add”
of the Internal Audit (IA) function is very much a topic of This Definition states:
scrutiny for Boards, audit committee members, senior
executives (Chief Executive Officer, Chief Financial Officer) “Internal auditing is an independent, objective assurance and
and virtually all IA stakeholders. In many instances, the consulting activity designed to add value and improve an
IA function is also being asked to do more with fewer organization’s operations. It helps an organization accomplish
personnel and to leverage technology in all their activities. its objectives by bringing a systematic, disciplined approach
While many Chief Audit Executives (CAEs) regularly report to evaluate and improve the effectiveness of the risk
the number of audits completed vs. planned, the number of management, control and governance processes.”
high risk issues identified, actual audit hours vs. budgeted
hours, and actual function costs vs. budgeted costs, the While the Definition generally drives the focus of many
question remains whether these measures are truly the IA functions, in today’s regulatory environment - and for
most meaningful. Are they enough to show that consistent global organizations - there are additional requirements
value is provided to a company? that IA examine specific areas of a company and, in some
instances, report out their overall results. It is these
In order to arrive at meaningful metrics, the first step is to additional requirements, as well as other areas to which the
gain an understanding of the true “mission” of IA. While this audit committee and senior management may direct IA’s
may be described in an IA mission statement, it is critical focus, which drives actual and perceived IA value.
for the function to adhere to best practices, generally
governed by the Institute of Internal Auditors International As many recent IA surveys have shown, audit committees
Professional Practices Framework (IPPF). The IPPF, which and senior management struggle with gaining comfort
includes the International Standards for the Professional that true “value” is consistently provided by IA functions.
Practice of Internal Auditing (Standards,) is a conceptual It is imperative that the true mission of IA is understood
framework which organizes authoritative guidance and communication of the results of IA activities be aligned
promulgated by the Institute of Internal Auditors (IIA). to that mission. In this regard, identifying the “assurance”
While adoption of the IPPF is not mandatory, adherence to and consulting/advisory role of IA is imperative. For many
it indicates an IA function is following the best practices stakeholders, it is in the consulting/advisory role that they
in internal auditing. In addition to including the Standards believe most IA value is provided. While other stakeholders
and requiring internal auditor adherence to the IIA Code of may see IA as primarily an “assurance” provider that may
Ethics, the IPPF includes a Definition of Internal Auditing. not have the skills to provide consulting/advisory services.
This Definition and/or its key components is generally

1
 GRC

“A successful Internal Audit function is made up of people with the right skills, who are business partners with management
and provide insight into identifying and addressing risks of the company, including emerging risks. It is this incubator of
risk-focused people who we also look to enter the business and assist the company in achieving its long term objectives.”

In today’s environment, while the IA assurance function is and focus on Information Technology and emerging risks,
still important and will always continue, there is a growing the review of an organization’s risk management processes,
trend of IA also providing consulting/advisory services. or the ability to have risk-focused IA personnel move into
In short, no matter how the IA function is perceived - other areas of an organization. Individual auditees are often
as assurance provider and/or consultant/advisor, it is focused on having consistent recommendations that will
imperative that the CAE communicate key metrics that are assist in meeting their operational and strategic objectives.
aligned in these areas. In addition, the external auditor is generally concerned that
competent IA personnel will assist not only in completing
key control audits, but also in completing external audit
RECOGNIZING STAKEHOLDERS assistance work – which helps with their attestation needs.
With the mission of the IA function clearly understood in
order to determine what metrics will assist in showing IA When we recently discussed expected IA value with audit
value, the various stakeholders of IA must be identified. committee members, executive management and auditees,
While we have previously alluded to audit committee all responses included important aspects of an IA function’s
and senior executives figure 1.1 below depicts the many mission. Just some of these included:
stakeholders of IA.
§§ “The value of Internal Audit to me is I don’t want
Because the CAE is clearly a stakeholder, he or she wants surprises, Internal Audit assists in reducing
to make sure that the metrics show that the IA function regulatory, reputational and financial surprises.”
has a clear mission, includes best practices in the field §§ “Internal Audit helps set a tone of accountability
of internal auditing and the IA output will be perceived to throughout the organization.”
provide consistent value to stakeholders. While the audit §§ “Internal Audit helps reduce the external audit fee
committee’s goals should be aligned to the CAE, as with and provides a level of assurance that we have
management there may be specific areas where it believes proper controls in place and that they are operating
a great deal of value resides. These can include feedback effectively.”

2
GRC

§§ “A key value Internal Audit provides is the issues they identify and how they partner with management to arrive at
viable actions to address those issues.”
§§ “In today’s world, I look not only for Internal Audit to provide assurance over controls but to also provide input to help
our organization achieve our objectives and overall strategy.”
§§ “A successful Internal Audit function is made up of people with the right skills, who are business partners with
management and provide insight into identifying and addressing risks of the company, including emerging risks. It is
this incubator of risk-focused people who we also look to enter the business and assist the company in achieving its
long term objectives.”

KEY METRICS
While there may be different areas of focus and corresponding priorities for various stakeholders, a common measure for IA
value should also address:

§§ Presence of robust IA policies and procedures which drive IA activities

§§ Skillsets, abilities and relationships of IA personnel
§§ Evidence that the IA focus and results are aligned to the organizational primary risks

Having a true “Balanced Scorecard” which addresses the areas noted, shows IA focus, and one that is used to communicate
results, helps demonstrate the consistent value of IA. Some of the key measures in each of the three areas are summarized
in figures 1.2, 1.3 and 1.4.

*In the below charts – X represents a priority area for the applicable stakeholder.

Figure 1.2-Robust Internal Audit Policies and Procedures

3
 GRC

Figure 1.3-Skillsets, Abilities and Relationships of Internal Audit Personnel

Figure 1.4-Alignment of Internal Audit to Organizational Primary Risks

4
GRC

Presence of robust Internal Audit policies and Skillsets, abilities and relationships of Internal Audit
procedures which drive Internal Audit activities personnel

For CAEs it is imperative that they have written policies Two highly useful means of helping CAEs in carrying
and procedures that are aligned to the IPPF, including out IA activities include not only having personnel with
internal quality control procedures, and the completion of various certifications (CIA, CISA, CRMA, CFE, etc.), but
an External Quality Assessment Review (QAR). While the also maintaining a matrix of areas of expertise by person
QAR has been a requirement for many years, a number of and a related gap analysis. This gap analysis is a driver
organizations have either not had QARs completed, or they for filling internal audit positions and it uncovers any
are not always completed within the required 5 year time need to seek outsourcing of Subject Matter Experts.
frame. Another key area is assuring that all regulatory IA Moreover, an important value add to organizations is the
requirements are memorialized and completed on a timely development of relationships between IA personnel and
basis. company management. This enhances the IA personnel’s
understanding of the business and their ability to add value.
Other core metrics include having an established process Measurement of formal feedback from management on
under which any “High” rate audit issues/recommendations each auditor is obtained on an annual basis.
are addressed within a reasonable timeframe (e.g. 60 days
of report issuance) and that all report issues are addressed An excellent measure of IA value is the number of
with management actions within no longer than 30 days personnel that have been transferred from IA to other
from target completion date. positions in an organization. Having IA serve as a talent
incubator for the organization as a whole is a consistent
One item many auditees, senior management and audit positive for many organizations. Also gaining momentum
committee personnel look at is the number of audit issues in many organizations are rotation programs where
addressed before the final report is issued. When this is specialized, skilled personnel from other departments
done, evidence of true partnering by IA with management is transfer into the IA function for 12 to 24 months. In many
evident. organizations, another value indicator is the number of
“special requests” relating to key initiatives on which
There is also an increased focus on being able to deliver management asks for IA involvement.
methods and tools that the organization will be able to
re-use independently moving forward. Generally in these Finally other key metrics include the number of auditors
instances, using automated tools and/or a designed per number of employees as well as the number of auditors
program, IA establishes a process to identify/analyze risks per annual revenue dollars.
to an organization (review and analysis of third party data,
etc.) that can be implemented by the business and therefore Evidence that IA focus and results are aligned to the primary
allowing the “process” to be examined by IA in the future. organizational risks

Some other key metrics include; The final area for measuring IA value is the daily focus of
the IA function. That is, helping an organization accomplish
§§ R
eports issued within XX days (e.g. 45 days) of its objectives by assisting management in improving the
fieldwork effectiveness of the risk management by focusing on the
§§ Actual annual audit plan hours vs. budgeted hours primary risks of an organization, while at times might not
§§ Number of completed audits vs. planned audits be easily measured, should be a key driver of IA activities.
§§ Consistent use of surveys at the completion of each While this may be difficult to quantify, given IA’s technical
audit to obtain and report on auditee management abilities and their forum to drive change in an organization
feedback it is imperative that IA consistently communicates to all
§§ Consistent use of Computer Assisted Audit stakeholders how they contribute to identifying risks and
Techniques (CAATs), continuous auditing and related assuring they are sufficiently addressed.
reports produced to show value in identifying
anomalies within entire populations

5
 GRC

One of the main deliverables that assist in this process

is a formal reconciliation of Internal Audit, Sarbanes
Oxley, Risk Management, Compliance and external audit
risks and coverage. Some companies complete this via
a formal document which is updated on a regular basis.
This document details organizational risks, as well the
processes in place to address the risks. Linking each IA
report finding to major risk areas of the organization is a
clear indication of value received. This linkage may include
highlighting the impact of the audit issue and overall audit
result to the risk as a whole. This includes identifying risks
that exist in attaining an organization’s strategic objectives.

Since IA is uniquely qualified in that they understand the

risks of the organization, any audits that directly review an
organization’s risk management process or Information
Technology risks (cybersecurity, etc.) should be highlighted
to all stakeholders. Moreover, with the increased emphasis
on emerging risks and fraud, any audit committee or senior
management update on emerging risks and statistics on
number of fraud related report findings is also a value add
to key IA stakeholders.

SUMMARY
While many IA functions provide consistent value
to organizations, the process of measuring and
communicating this value is not “one size fits all.” As such,
to ensure both the reality and perception of consistent
value being provided, IA needs to be focused on their
mission as well as how they serve and report results to
their various stakeholders. Attending to the needs of the
stakeholders should assist in the communication and level
of detail showing consistent IA value. A balanced approach
is recommended where updates and related statistics are
maintained and communicated, focusing on measures that
relate to adherence to robust IA policies and procedures,
the abilities of IA personnel and IA’s focus on the company’s
primary risks. If this is done, evidencing IA value will surely
be more straightforward and better measured!

6
 CONTACT
Michael Flagiello | Partner
Bill Mellon, Partner
(P) 212.375.6639
(P) 267.532.4328 (C) 215.287.0468
[email protected]
(E) [email protected]
Robert Cummings | Partner
(P) 212.375.6522
Nicolas Quairel, Principal
[email protected]
(P) 646.225.5983
(E) [email protected]

About WeiserMazars
WeiserMazars LLP provides insight and specialized Locally and internationally, we build lasting relationships
experience in accounting, tax and advisory services. with our clients by addressing their particular needs,
creating value and optimizing their organizational
Since 1921, our skilled professionals have leveraged performance.
technical expertise and industry familiarity to create
customized solutions to overcome client challenges. For more information visit us at www.weisermazars.com

As the independent U.S. member firm of Mazars Group – the

11th largest accounting organization in the world – we have
a global reach of nearly 14,000 professionals in more than
70 countries.
Follow us on

WeiserMazars LLP is an independent member firm of Mazars Group.