Metrics 3: Improvements due to implemented recommendations is an important measure of effectiveness of the audit function. The internal audit function should monitor the number of recommended controls and their implementation as unimplemented recommendations can be very problematic and could create control gaps for the organization irrespective of how few they might be. Where recommended controls were not implemented, it could also mean that some of the recommended controls and countermeasure are not feasible and implementable and as such, will not add any value to the business if pursued. This speaks to the effectiveness of the audit assessment and its ability to understand and diagnose the business risk, challenges and controls, their root causes and how it delivers value through its assessment.
Metrics 4: One of the crucial measures of the effectiveness of the audit function is its ability to plug income leakages, wastage and financial improprieties. As such, management must be seen to be prudent in the deployment of organization’s resources for its good and ensure optimization of resources available to it. In doing so, the internal audit function must ensure that revenue assurance and cost savings/optimization initiatives form part of its control testing or assessment. While introducing and implemented cost saving initiatives during audits, it is important that adequate resources are provided to the audit team for field work activities rather than starve them of funds needed to do the job in the name of cost containment. This has led to some organization failing to focus attention on critical risk areas such as governance issues, poor decision making, ineffective risk management and poor control environment while trying to save cost.
Metrics 5: Staying within audit budget shows efficient management of internal audit resources, which is good but the audit function should not be afraid to go the Board Audit Committee or Executive Management to ask for more funds that it requires to meet needs of emerging risk that were not initially anticipated in the planning stages of its activities. As such, resource limitation should not be enough excuse for failing to take on and address risk areas that were not initially anticipated in the planning stages of the audit.
Metrics 6: The internal audit function while conducting its activities should be able to identify loopholes and vulnerabilities in systems, processes and technologies that have the potential to be exploited for by internal and external parties to defraud the organization or perform malicious activities that could harm or damage the reputation of the organization.