Metrics for Measuring Internal Audit Effectiveness
In determining the effectiveness of the internal audit function, below are some of the metrics identified to help in measuring how effective or otherwise the internal audit function is and what forms the opinion of key stakeholders in that direction.
- 1. Audit plan coverage (audits performed as against audit plan).
- 2. Quality of audit findings/observations.
- 3. Improvements due to implemented recommendations.
- 4. Revenue assurance and Cost savings initiatives (income losses recovered, duplicate payments and vendor overpayment detected).
- 5. Potential fraud prevented.
- 6. Savings on internal audit budget.
- 7. Quality Assurance Review.
Metrics 1: Percentage of planned audit completed is a good way of measuring the efficiency of the internal audit function but does not tell the whole story about its effectiveness. Where the audit plan is not risk based, achieving high percentage of the audit plan does not amount to the internal audit function being effective rather it only shows the activities of the internal audit function, which may not meet the strategic needs of the organization as well as its stakeholders. Yes, achieving high audit plan coverage is laudable if the audit function has the resource to achieve such fit and the audit plan abinitio, was based on the strategic needs of the organization and emerging risk and control issues faced by the organization were duly considered. The audit function must also be dynamic in its planning to accommodate such demands as special reviews, spot checks, compliance checks and investigative reviews that may be required of it by the Board Audit Committee and Management of the organization in response to emerging risk, loss events and other incidents that pose a threat to the organization in the course of the fiscal year.
Metrics 2: Quality of audit findings/observations made by the internal audit function is important to the key stakeholders and demonstrates that internal audit is on top of the key risks issues and business pain points facing the organization whose impact would have been on the business had they not been raised/reported. So, the attention is on the quality of discoveries made during audits that could impact on the organization’s bottom-line and its ability to effectively discharge its obligations to stakeholders. For example, number of potential frauds averted, number of material misstatements discovered or number of process improvements introduced into the system as a result of audit assessment. It is also important for the internal auditors to investigation and ascertain the root causes of the issues discovered to enable management address them rather than throwing effort or resources at the issues and as such, will ensure the issue doesn’t repeat in the future. An effective internal audit function, over time leads to maturity in governance, internal control systems and risk management as the iterative process of internal audit contribute to process improvement.
Metrics 3: Improvements due to implemented recommendations is an important measure of effectiveness of the audit function. The internal audit function should monitor the number of recommended controls and their implementation as unimplemented recommendations can be very problematic and could create control gaps for the organization irrespective of how few they might be. Where recommended controls were not implemented, it could also mean that some of the recommended controls and countermeasure are not feasible and implementable and as such, will not add any value to the business if pursued. This speaks to the effectiveness of the audit assessment and its ability to understand and diagnose the business risk, challenges and controls, their root causes and how it delivers value through its assessment.
Metrics 4: One of the crucial measures of the effectiveness of the audit function is its ability to plug income leakages, wastage and financial improprieties. As such, management must be seen to be prudent in the deployment of organization’s resources for its good and ensure optimization of resources available to it. In doing so, the internal audit function must ensure that revenue assurance and cost savings/optimization initiatives form part of its control testing or assessment. While introducing and implemented cost saving initiatives during audits, it is important that adequate resources are provided to the audit team for field work activities rather than starve them of funds needed to do the job in the name of cost containment. This has led to some organization failing to focus attention on critical risk areas such as governance issues, poor decision making, ineffective risk management and poor control environment while trying to save cost.
Metrics 5: Staying within audit budget shows efficient management of internal audit resources, which is good but the audit function should not be afraid to go the Board Audit Committee or Executive Management to ask for more funds that it requires to meet needs of emerging risk that were not initially anticipated in the planning stages of its activities. As such, resource limitation should not be enough excuse for failing to take on and address risk areas that were not initially anticipated in the planning stages of the audit.
Metrics 6: The internal audit function while conducting its activities should be able to identify loopholes and vulnerabilities in systems, processes and technologies that have the potential to be exploited for by internal and external parties to defraud the organization or perform malicious activities that could harm or damage the reputation of the organization.
Back To Internal Audit Leading Practices