The importance of internal audit value delivery to the organization it serves has been recognized and encouraged by The IIA for years. In fact, value focus is noted in the International Professional Practices Framework (IPPF) elements, including the Mission, Definition, International Standards for the Professional Practice of Internal Auditing, Code of Ethics, Core Principles, and The IIA’s Value Proposition.
Today, value can only be delivered when internal audit innovates in who it hires, what it assesses, and how it executes and communicates; understands and aligns with organizational strategies; and has a laser focus on critical and emerging risk areas. Stakeholders expect internal audit to have broad, unrestricted scopes expanding beyond financial risks and encompassing operational and strategic areas. Increasingly, stakeholders expect internal audit to address not just hard topics, but also soft topics, such as the quality of the culture and the control environment. The services internal auditors provide to stakeholders must deliver:
- Knowledge about major organizational risks, related mitigation, and needed improvements.
- Assurance that sufficient risk mitigation (generally internal control) is in place and operating.
Objective insights, arising from analysis and organizational experience, to improve organizational agility, efficiency, and effectiveness.
Knowledge, assurance, objectivity, and insight are difficult to measure directly. Many CAEs resort to process measurements, such as completion of the approved audit plan or meeting cycle time to issue a final report, as surrogates for measuring the value of their services.
The Wrong Metrics
Internal audit is not the only profession that struggles with the value question. For example, in the medical field, value — or quality of care rendered — is certainly a goal. But quality of care is hard to objectively measure, so doctors often are evaluated by process measures, such as the number of patients treated in a day. Unfortunately, this may reduce the ability to achieve the value goal, as doctors motivated to see more patients may spend less time with each one, resulting in less ability to understand and deliver the quality of care required.
Similarly, CAEs who focus on process metrics such as completion of the approved audit plan may undermine their value delivery goal by focusing on finishing audits, rather than considering extending an audit to deliver better assurance or more focused recommendations. Or consider the risk of perfectly executing the wrong plan that delivers zero value, but results in a high metric. Clearly, completion of the audit plan does not measure value delivered. But what metric does or could?
Challenges of Measurement
Directly measuring value is challenging. Examples of some of the more significant challenges to measuring value are described here.
Stakeholder Expectations Internal auditors must first understand what their stakeholders want and how they view value, and then measure against those wants and expectations. But the reality is that some stakeholders may not understand the breadth of capabilities a modern internal audit function has, or may even want a less aggressive function that doesn’t challenge the status quo. In such a situation, stakeholder expectations may be significantly lower than the role described in the Mission and Definition of internal auditing. The opposite is also possible, with stakeholder expectations far exceeding a reasonable performance level. And to make it even more challenging, expectations might vary for the board versus senior management. Audit research has shown that boards focus more on assurance while management primarily seeks new insights from internal audit.
Subjective Nature Value is often in the eye of the beholder and not easily quantified. For example, an internal auditor who helps management identify and correct inefficiencies in a new process design is certainly delivering value. But how does one quantify time and resources not wasted on a design because it was corrected pre-implementation?
Client Surveys Many CAEs presume they can measure value by asking clients if they have received value from audit work performed. The challenge is that client responses may be skewed by their emotional reaction to a recent audit. Or they may not have a reasonable or best-in-class expectation so their feedback may be based on flawed criteria. Finally, surveys may be asking the wrong questions by inquiring about audit processes rather than value received.
Nature of the Audit Engagement One objective of an assurance engagement is to assess the effectiveness of risk management and report on the assessment to the board and senior management. Value may come from providing assurance that risks are well-managed. In other engagements with an advisory focus, such as helping management design risk management processes for a new acquisition or system, value may be less about assurance and more about providing recommendations to improve a control design. In audit investigations, value may be about dollars recovered. This is not to suggest these three examples are mutually exclusive. But it does affirm that value is complex and it is unlikely that any one metric can cover any and all services.
Importance of Measurements
Internal auditors want to make a positive contribution to their organizations. Unfortunately, in far too many cases, the measurements or key performance indicators that the profession uses to attempt to measure staff (and perhaps evaluate staff) can unintentionally drive the opposite behavior desired.
Stories abound of auditors who focused on the timeline, the budget, or the calendar — delivering against standard metrics but not delivering true value. Worse are the stories where auditors avoided audit areas that could have provided value in favor of maximizing process metrics, such as concluding an audit on time by ignoring warning signs that emerged late in an audit.
A Balanced Approach
|INTERNAL AUDIT FOUNDATIONS|
Aside from having the right measurements, the foundations of the internal audit function must already be in place. Their importance cannot be overstated.
- A documented mission focused on value delivery and helping the organization achieve its strategies and objectives.
- A clear and appropriate charter providing requisite authority, access, and unrestricted scope.
- A risk-based audit plan approved by the board that is routinely adjusted as the organization’s risks change.
- A professional team with broad and appropriate skills and qualifications.
- A courageous and respected CAE who is willing to tackle and communicate challenging issues, while striving to innovate and continuously enhance the team’s capabilities and performance.
- Regular interaction with, and feedback from, key stakeholders to ensure a mutual understanding of evolving expectations.
To avoid the shortcomings of solely relying on process metrics, CAEs should implement a balanced set of complementary measures. These measurements, tracked over time, can indicate if a function’s focus on value is, in fact, the top priority for the audit team and paying off in organizational improvements and client satisfaction. The four categories of measurements recommended include value drivers, client behavior, client feedback, and audit process. Coupled with the elements listed in “Internal Audit Foundations” at right, these balanced measurements enable internal audit to plan, execute, measure, and communicate value delivered.
Value Drivers These measurements consider the fundamental behaviors that should lead to relatively higher quality performance. Measurements such as the percentage of auditors with masters’ degrees or certified internal auditors, adherence to the IPPF, or the percentage of auditors with operating or managerial experience will increase the likelihood of value delivery.
Client Behavior These measurements reflect value if management or the board solicits internal audit assistance, positively corrects identified audit issues timely, and actively seeks internal auditors for special projects or open positions. These can include increasing requests over time from a cross section of functions within an organization, the trend of corrective actions implemented on time, a reduction of repeat findings, or the number of auditors placed in other roles throughout the organization.
A positive trend in such metrics suggests that management recognizes the value of the internal audit function and the importance of correcting issues noted. To achieve a positive trend, internal audit must focus on higher relative risk areas, effectively communicate the importance and impact of audit issues identified, and help identify solutions that address the root cause. The “Why did this happen?” and “Who cares?” questions must be convincingly answered to persuade management to reprioritize activities and implement corrective action. To be sought out for new roles, auditors must earn management’s respect for their organizational knowledge, balanced judgment, communication skills, and ability to identify and help manage risks.
Client Feedback Client surveys can be an effective tool to capture the subjective view of value from management’s perspective. However, they must be used with great thought and care. Suggestions for ensuring the effectiveness of this tool include:
Focusing surveys on management’s perceptions and experiences with the audit team and results, and not on the audit process. Surveys that ask if a planning meeting was held or if the report was issued timely focus on the process and provide information that audit management should already know. Rather, ask questions to solicit management’s viewpoints. Did the audit team present itself professionally? Was management informed on the area under review? Were the results presented accurately, fairly, and timely? Did management receive value from the audit? Would management seek internal audit’s assistance in the future?
Providing an opportunity for written comments, not just numerical ratings. Better yet, offer an opportunity for a live conversation with the CAE or internal audit management to discuss and probe areas of satisfaction or dissatisfaction.
Avoiding using client survey results in auditor performance reviews, which risks creating a conflict with the auditor when difficult issues arise in an audit. Auditors should be courageous and willing to question the status quo to offer insights. The last thing an auditor should ask is, “Do I pursue the issue and irritate management, which is evaluating me soon? Or do I soften or drop the issue to get a higher rating?”
Audit Process These measures are typically used today. Value is inferred if the audit plan has been approved and is executed timely — with appropriate changes as the risk profile of the organization evolves — and if audit results are communicated timely. It remains useful when balanced with other measurements and are not the primary focus of performance feedback.
Reinforcing Audit's Mission
Organizations are changing at warp speed. To keep up, internal audit needs to be agile, responsive, and focused on value delivery — and the right metrics can reinforce the desired value-based behaviors. Even with a balanced set of measurements, value delivery is still not directly measured. However, by evaluating value drivers, client behavior, and client feedback trends, as well as audit process measurements, audit management will have a much stronger indication of value delivered and improvement over time. And, critically, this balanced set will reinforce the value-based mission of the internal audit function, motivating the audit team and minimizing the risk that it focuses on the due date and budget rather than the substance of the audit.