Performance indicators

By Pierre Gagné
Illustration: Mike Constable

Once in place they make it possible to review internal auditors’ work and are a key factor to an organization’s success

Internal audit is a recognized strategic function in both public and private organizations. The internal audit department is mandated to provide senior managers and audit committee members with the needed support to achieve objectives, improve management practices and performance and implement controls to mitigate risk. Accordingly, the internal audit department must have a well-established structure if it is to effectively address these concerns. Performance indicators constitute a key factor in the department’s success.

The following indicators are taken from a 1999 guide developed by Quebec’s public service Forum of Internal Audit Administrators (www.frvi.gouv.qc.ca).

Why measure?
Internal auditors often recommend that clients adopt indicators and set targets to appropriately monitor their operations. How does this advice apply to internal audits?

Using indicators to measure performance is an effective way to regularly assess added value and the professionalism extended to senior management, audit committee members and managers being audited. This approach also allows internal auditors to work with staff in setting objectives and targets. Lastly, a number of indicators conform with the requirements of internal audit professional standards.

Prerequisites
To gather information about these indicators, internal auditors need to have systems in place for compiling data. In this respect, they must:

prepare an annual plan of mandates to be performed;
have a system for recording the number of hours spent on each mandate;
annually follow up on recommendations made in previous reports;
request action plans after submitting their internal audit reports;
determine direct and indirect costs;
prepare a time budget and a time line at the beginning of each mandate;
compile the number of professional development days for internal auditors;
use a questionnaire to survey the opinions of internal audit clients and senior management on internal audit performance and results of the work.

The performance indicators used break down into two categories: quantitative and qualitative.

Quantitative indicators
Twelve quantitative indicators measure how the internal audit function has an impact on the organization, on internal management and on the outcomes achieved. Some indicators are measured after each internal audit mandate and others at regular intervals. Targets are set in consultation with management, audit committee members and internal audit staff. Measurement results are reflected in the annual internal audit report and, more particularly, they provide a basis for some interesting discussions with senior management and audit committee members.

Compliance with initial planning This indicator compares the internal audit activities achieved with those initially planned. It is based on planning developed in agreement with management and audit committee members. The internal audit plan is primarily derived from the internal auditor’s assessment of the organization’s risks and the concerns of senior management and the audit committee. This indicator enables audit committee members and senior management to ensure that the internal audit focuses on selected areas that add value to the organization, particularly areas involving material risks.

The internal audit department reports to the audit committee on a quarterly basis. The success rate for this indicator is set at 80%. Even though time is set aside for special mandates, planned work must often be postponed when unscheduled yet important mandates arise. However, these postponed mandates are then included in the next year’s planning.

Time spent on audit work This indicator measures the time spent on internal audit work (audits, special mandates and advisory services) in relation to all department activities and the productivity of internal audit staff. Internal audit employees are given a target of 80%, which they have no problem meeting. This indicator enables senior management and the audit committee to monitor the efficiency of the internal audit function and ensure that staff is working on files relating to the organization’s mission.

Time spent on special requests versus audit work This indicator shows the importance management places on the internal audit function. For instance, when internal auditors are called on to resolve an urgent problem, their credibility, the climate of trust that prevails in the department and their contribution to the organization is reflected in this indicator. If the department does not receive any special requests, the question would be why. This indicator reflects the time spent on mandates and special requests such as advisory services, rapid analysis of a document, etc. However, such requests should not become common practice. While the internal auditor’s advisory role is often appreciated, it shouldn’t interfere with scheduled mandates. That’s why this indicator is important to track such requests, which shouldn’t constitute more than 20% of internal audit work. This indicator is of value to senior management since it highlights the internal auditor’s commitment to the organization.

Implementation of recommendations (total or partial) This is the most important indicator since it is directly related to the internal auditor’s mission, which is to make recommendations to improve the organization’s practices. It determines the extent to which the internal audit recommendations have been implemented and the impact on the organization. Consequently, the recommendations must be realistic and provide added value. The goal is to have 80% of the recommendations implemented or in the process of being implemented. In this way, senior management can ensure that managers introduce measures based on the recommendations and assess the effect of the internal audit work on the organization. This indicator also enables internal auditors to review their recommendations.

Time line for implementing the recommendations This indicator measures the scope and feasibility of the recommendations. Those having a significant impact on the achievement of the organization’s mission should be quickly implemented. Moreover, it is not advisable to make too many long-term recommendations, as they could end up being a wish list. The action plan is an important document in ensuring management adopts the measures on a timely basis. If internal auditors have reservations about the time line for implementing the measures, they can discuss it again with managers and inform the audit committee. Furthermore, this committee oversees the rapid and systematic implementation of the measures, which impact the purpose, governance, risks, controls and integrity of the organization.

Potential monetary benefits of the recommendations This indicator cannot be measured on a regular basis. What’s more, the internal audit’s added value should not be based on this indicator alone. In some situations, this indicator can measure the impact of the internal audit work and the inherent quantifiable monetary benefits. It also requires internal auditors to perform value-for-money type audits. In reality, the recommendations do not always produce quantifiable monetary benefits. Nonetheless, circumstances permitting, these recommendations add value to the work performed by internal auditors. This indicator helps senior management understand that internal auditors are always concerned about optimizing the organization’s resources and promoting savings. However, since the organization’s managers are the ones who must make decisions and take action, all the credit shouldn’t go to the internal audit function.

Hourly cost of the internal audit function This indicator determines the cost of internal audit mandates and activities. It is a way to compare results with related costs and to determine whether the organization received value for money. At the end of each mandate, the work is evaluated with the internal auditors. This enhances employee awareness and ensures that future reviews and practices are more effectively targeted. The hourly rate can also be benchmarked against the market rate. This indicator is subsequently discussed at meetings with the audit committee and senior management, who are then able to appreciate the cost of the internal audit function.

Compliance with time budget for each mandate completed
Compliance with time lines for each mandate completed
These two indicators are used to ensure compliance with direct labour time budgets and the time lines set for completing each mandate. They are first used to measure the number of hours worked compared with the time budget and the prescribed time line, according to an acceptable variance threshold. Then, a determination is made of the number of mandates that were completed on target. These indicators are discussed in meetings with the auditors at the end of each mandate. They help to improve the planning of the direct labour budget and time lines and to focus on activities that require more attention during the mandate. Lastly, these indicators demonstrate the thoroughness of the internal auditors’ work to senior management.

Internal audit resources This indicator addresses an important issue that is regularly discussed with senior management but for which the frames of reference remain unclear. It determines whether the organization has sufficient internal audit staff. It is based on metric units established according to previous experience in the field. It should be consistent with other aspects of the organization, including the budget, the nature of operations and the risk map prepared by the internal audit department. It should also take account of other stakeholders such as the auditor general, controller, program evaluation staff, consultants, etc. This indicator can also be based on benchmarks in the internal audit field. To determine the staff needed, managers should consider the following:

Is the information required to meet the objectives available?
Is the information reliable?
Are the controls applied properly?
Are there potential risks?
Are all operations optimal and effective?
Are policies and guidelines properly followed?

If the answer to several of these questions is no, managers should then determine whether the internal audit function can address the issue. Although this indicator isn’t perfect, requirements in these areas could be included on the agenda of meetings with senior management and the audit committee.

Quantitative internal audit performance indicators
Indicator	Scope	Target
1. Compliance with initial planning	Measure the proportion of internal audit activities completed in relation to those initially planned and approved by management	Complete more than 80% of mandates scheduled in the initial planning process.
2. Time spent on audit work	Determine the time spent on internal audit work (audits, special mandates and advisory services) versus all the department's activities	Spend 80% or more business days on audit work
3. Time spent on special requests versus audit work	Determine the importance management places in the internal audit function as regards certain specific needs	Spend no more than 20% of time on special requests
4. Implementation of recommendations (total or partial)	Determine extent to which the recommendations contained in internal audit reports have been implemented	Implement (all or some) 80% of recommendations
5. Time line for implementing recommendations	Measure the scope and feasibility of the internal audit recommendations	0 to 6 months (20%) 6 to 12 months (50%) 1 to 2 years (2%) 2 years or more (5%)
6. Potential monetary benefits of the recommendations	Measure monetary savings (recurring or unrelated to productivity gains or to reduced or discontinued operations)	Achieve savings over a three-year period at least (where applicable)
7. Hourly cost of the internal audit function	Determine the hourly cost of internal audit work	Below market
8. Compliance with direct labour time budget for each mandate completed	Determine compliance with direct labour budget allocated for each internal audit mandate	100% (accepted variance of up to 10%)
9. Compliance with timelines for each mandate completed	Determine compliance with timeline for submitting draft report to internal audit clients	100% (accepted variance of up to five days)
10. Internal audit resources	Determine the proportion of resources the organization has assigned to the internal audit function	Sufficient resources according to the size and nature of the organization
11. Time frame for issuing the draft internal audit report	Assess the timeframe established between the completion of the audit work and submission of the draft report to internal audit clients	Three weeks or less
12. Professional development	Assess the time devoted to professional development in order to ensure optimal quality of training of internal auditors	Five to seven days per auditor per year

Time frame for issuing the draft internal audit report This indicator assesses the time frame established between completion of the internal audit work and submission of the draft report to internal audit clients. Three weeks after the work has been completed, the client should in principle receive a report. Obviously, meeting with a client to discuss findings and recommendations is good practice.

Professional development This indicator measures continuing professional development aimed at enhancing the internal audit staff’s competencies according to professional standards and good practices. It is important to senior management that internal audit resources be well trained and competent since they have to advise managers and, in some instances, transfer their expertise and knowledge, e.g. in the case of risk management. Audit staff must also be up to speed on best practices in governance.

Qualitative indicators
Qualitative indicators complement quantitative indicators be-cause they can be used to assess other aspects of the internal audit department’s performance. Once the mandates are completed, audited managers receive an evaluation questionnaire on the internal audit work. The questions cover the following issues:

clarity of the objectives and approach;
relevance and feasibility of the recommendations;
new perspective provided by the report;
reliability and relevance of the findings;
clarity and understandability of the reports;
improvement of risk controls thanks to the recommendations;
regular feedback during the work;
tact and diplomacy exercised;
compliance with deadlines; and
managers’ satisfaction.

Once a year, the audit committee performs a self-assessment of the internal audit function. This exercise is intended to:

ensure added value by implementing a preventive proactive approach and assuming the role of change agent;
promote the adoption of a management assistance approach;
draft realistic recommendations;
take action in the right sectors in terms of risks; and
share expertise.

In addition, internal audit performance is regularly evaluated since internal auditors must be able to appropriately respond to the audit committee’s questions about their reports, and in general, about the organization’s risk management and control procedures.

Lastly, compliance with professional standards and internal audit performance should be assessed internally and externally every five years.

Conclusion
Performance indicators make it possible to regularly review the internal auditor’s work and contribution to the organization. This approach is implemented in conjunction with the auditors in order to improve internal audit practices and with senior managers in order to understand their needs and concerns. Performance indicator-based management is therefore a key factor in achieving success.

Pierre Gagné is the director of internal audit, surveys and assessment, at Revenu Québec. He is a member of the FRVI development committee and was involved in preparing the guide

Technical editor: Yves Nadeau, audit and risk management partner, RSM Richter Chamberland in Montreal