With the recent release of the
2018 Pulse of Internal Audit report, The IIA renewed the push for transformation in internal audit. From challenging internal audit to be more agile and innovative to pushing leaders to seek out the right talent while focusing on better engagement with the board, the report sets a serious tone for internal audit to be the source of its own disruption. I elaborated on this thinking in my recent blog post,
"Internal Audit's Digital Transformation Imperative."
All this said, I realize a key starting point is to change how we demonstrate the impact internal audit has. Because people tend to perform based on what they are measured by, it's time to challenge how internal audit measures its own performance.
A key performance indicator (KPI) is a measurable value that demonstrates how effectively objectives are being met. Internal audit KPIs are often execution-based metrics, meaning they generally measure the amount of work being done: percentage of audit plan completed, number of recommendations made, number of recommendations implemented, and hours spent per audit, among others. I call these the "look what I did" metrics. Some chief audit executives (CAEs) take a balanced scorecard view and include measurements around number of certified staff, hours spent on training, stakeholder feedback, etc.
While many of these metrics have their place, none actually measure the true value of internal audit. In fact, KPIs like "percentage of audit plan completed" often end up driving the wrong behavior. If audit committees focus only on whether or not the plan was completed, they miss the opportunity to see whether internal audit was focused on the right risks. It also serves as a disincentive to the CAE to modify the plan in response to emerging risks if the audit committee is left wondering why the CAE had to make this "last minute" change (when, in fact, the audit committee should be demanding the change).
For internal audit to measure the right things, we have to remember why we exist. The
Mission of Internal Audit per the International Professional Practices Framework is "to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight." With this in mind, the solution is simple, although challenging to implement depending on your organization.
Think about it: If internal audit is effective, shouldn't the audited business units' performance metrics improve once audit recommendations have been implemented? This may not be true in every case, but clearly most audits should result in some type of increased performance, decreased expense, increased revenue, etc. While we may not be able to attribute every metric change to internal audit, surely there should be some correlation between the implementation of certain audit recommendations and improved performance of that business unit.
We also need to consider the impact KPIs have on the perception of internal audit. For example, if you have a KPI around number of recommendations made and implemented, what message are audit clients receiving? They are likely to get the wrong message, which is "internal audit measures success based on quantity of audit recommendations; therefore, I should expect a number of recommendations as a result of this audit whether they are necessary or just plain busy work." Alternatively, if internal audit KPIs are based on having a positive impact on the business unit's KPIs, a sense of shared success is inherent.
Improving KPIs goes hand in hand with what internal audit must do to be innovative: focus on overall health, not just finances; build relationships with management and other stakeholders to understand shared goals; regularly revisit and revise plans as issues arrive; embrace new thinking and technologies.
The key is if we do our jobs well, the business will grow stronger. That increase in strength correlated with the implementation of actions taken as a result of good audits is how we truly can demonstrate the value of the internal audit function. While it is still important to have a few key output measures of the internal audit function itself, the true value internal audit brings is the positive impact it has on the organization.
That's my point of view, I'd be happy to hear yours.