Internal Audit Key

Performance Indicators
Key Performance Indicators
Just as any part of the business needs to be
measured for effectiveness and efficiency,
the internal audit function must undergo
the same assessment.
Communicating to the Board
The need for the IIA to communicate key
performance indicators to the Board of
Directors is set out in the Practice Guide,
“Interaction with the Board”.
From Practice Guide “Interaction with the Board”
Listed below are areas to consider for formal board communications.
G. Quality Assessments
The internal audit activity should develop an appropriate internal
assessment program and should identify appropriate Key Performance
Indicators (KPIs). KPIs of the internal audit activity provide a platform to
discuss issues relative to the internal audit activity and potentially gain
board support in making necessary changes. Establishment of KPIs
should be done in a group that includes senior management, as well as
the board, and there should be consensus that the KPIs chosen are
meaningful and appropriate.
In addition to being a driver in the discussion of issues relative to the
department, KPIs are relevant in the evaluation of the CAE’s performance.
Once the KPIs are understood and agreed to by the board, frequent
reporting of actual versus desired performance with detailed explanations
is essential.
In cases where the relevant KPIs cannot be met, timely
notification to the board should be prepared and include:
• Type of performance indicator involved.
• Discrepancy between desired performance and actual
performance.
• Reason for the divergence.
• Plans for closing the gap.
The KPIs should provide some indication as to improvements
being made to the internal audit activity resulting from the KPI
analysis. Also, results of the external and internal assessments
(as referred to in IIA Standard 1300) should be communicated to
the board, and the CAE should indicate how the
recommendations will be implemented.
IIA Guidance for KPIs
The IIA has provided guidance for process
of evaluating the performance of the
internal audit function in its Practice Guide,
“Measuring Internal Audit Effectiveness and
Efficiency”.
Executive Summary
Internal auditing plays a critical role in the governance and operation of
an organization. When effectively implemented, operated, and
managed, it is an important element in helping an organization achieve
its objectives. Organizations that effectively use internal auditing are
better able to identify business risks and process and system
inefficiencies, take appropriate corrective action, and ultimately support
continuous improvement. To maintain and enhance internal
auditing’s credibility; however, its effectiveness and efficiency
must be monitored.
Establishing performance measures is critical in determining if an audit
activity is meeting its goals and objectives, consistent with the highest
quality practices and standards. This practice guide provides guidance
to internal audit activities on measuring their effectiveness and
efficiency and the level of customer service they provide to
stakeholders.
The first step is to identify key performance measures for activities that
stakeholders believe add value and improve the organization’s operations.
Examples of stakeholders include the board, executive management, external
government bodies and regulators, the external auditor, as well as the internal
audit activity itself.
Sources to consider when identifying key performance effectiveness and
efficiency measurements of the internal audit activity include The IIA’s
International Professional Practices Framework (IPPF), the internal audit
charter and mission, applicable laws and regulations, and audit strategies and
plans.
Effectiveness and efficiency measurements can be quantitative and
qualitative. In addition to compliance with The IIA’s International Standards
for the Professional Practice of Internal Auditing (Standards), audit activity
performance measures may include:
• Level of contribution to the improvement of risk management, control, and
governance processes.
• Achievement of key goals and objectives.
• Evaluation of progress against audit activity plan.
• Improvement in staff productivity.
• Increase in efficiency of the audit process.
• Increase in number of action plans for process improvements.
• Adequacy of engagement planning and supervision.
• Effectiveness in meeting stakeholders’ needs.
• Results of quality assurance assessments and internal audit activity’s
quality improvement programs.
• Effectiveness in conducting the audit.
• Clarity of communications with the audit client (often referred to as
“auditee”) and the board.
Once key effectiveness and efficiency measurements and targets
have been identified, a monitoring process and a method of
reporting to stakeholders should be established (e.g., format,
timing, and metrics). It is important for the internal audit activity to
obtain feedback from key stakeholders on audit effectiveness
and make adjustments where needed.
Performance Measurement
Process
The CAE needs to establish this process.
From Practice Guide “Measuring Internal Audit Effectiveness and Efficiency”
Internal auditing must effectively demonstrate its value as a key component of
the organization’s governance framework. The audit activity can lead by
example with strong, relevant, and reliable performance measures.
Establishing the Performance Measurement Process
To create effective performance measures, the chief audit executive (CAE)
needs to establish a process for:
• Identifying critical performance categories such as stakeholder satisfaction,
internal audit processes, and innovation and capabilities.
• Identifying performance category strategies and measurements. Strategies
should be pursued in compliance with IIA Standards, other applicable
professional standards, and applicable laws and regulations and should
ensure stakeholder satisfaction. The use of performance measures can be
an element of the internal audit activity’s internal assessment process to
comply with The IIA’s Standards.
• Routinely monitoring, analyzing, and reporting performance measures.
Steps to Establish
Performance Measures
1. Define internal audit effectiveness
2. Identify key internal and external
stakeholders
3. Develop measures of internal audit
effectiveness
4. Monitor and report results
Categories of Measures
The specific KPIs that are selected for the
internal audit function will be specific to
that organization.
1. Stakeholder satisfaction,
2. Audit processes, and
3. Internal audit innovation and
capabilities.
Considerations in Developing
• How effective are the performance
measures linked to the internal audit
activity’s strategy?
• Do performance measures include both
leading and lagging indicators?
• Do performance measures reflect the
mandate and role of the activity?
• How effectively are performance measures
used for continuous improvement?
Qualitative and Quantitative
Quantitative performance metrics are
often based on existing or obtainable
data and are easily understood.
Qualitative metrics are often based on
the collection of unique information
through more time intensive methods
such as survey research or interviews.
Categories of Specific Measures
• Basic measures
• Service to stakeholders
• Knowledge of business
• Technical development
• Innovation
• People development
Reporting the KPIs
The effectiveness and efficiency of the
internal audit function should be
reported periodically to the
stakeholders.

The specific form of the reporting will be

dependent upon the organization.
Monitoring the KPIs
As with many things in a business, the KPIs
that are selected for the internal audit
function need to be monitored over time to
ensure that the selected KPIs are still
relevant and are still the best KPIs.
Performance Measurement System
Internal auditors do not create it, but need
to make certain that it is sufficient.

Needs to be based off of the objectives of

the company and measure what is
important for the company to do to
achieve its objectives.