Part 2. 8.

9. What are key

performance
indicators?

A performance indicator is a means of report on a range of KPIs. The IIA consider that
measuring the extent to which an individual, the essential first step is to identify KPIs for
group, or entity is meeting its objectives. activities that stakeholders believe add value
Initially a key performance indicator was a way and improve the organization’s operations.
of denoting the most relevant performance
indicators for a particular organization.
However, the terms performance indicators
and KPIs are now often used interchangeably. KPIs for internal audit

KPIs should provide management with a

Internal audit clear indication of the performance and
quality of the internal audit function and
standards should be an integral part of the internal
audit system. They should focus on the added
value generated by internal audit activity for
The Institute of Internal Auditors (IIA)
both internal and external stakeholders. The
International Standards for the Professional
performance measures captured in KPIs can
Practice of Internal Auditing on Quality
be quantitative and qualitative.
Assurance and Improvement (IPPF 1300)
require that internal audit units carry out • Quantitative performance measures
internal assessments including “ongoing are often based on existing or easily
monitoring of the performance of the internal obtainable data and are easily understood
audit activity”. In 2010, the IIA issued a (for example percentage of completed
Practice Guide on Measuring Internal Audit vs. planned audits). They often require
Effectiveness and Efficiency. This explains less effort to collect and are readily
that a critical element of this monitoring is for comparable to the same metrics in other
internal audit units to establish, measure, and organizations.

6
 Figure 1. KPIs for internal audit should be

1. Part of the management systems of the internal audit function

Performance measurement process Quality assurance process

2. Indicators of the value internal audit delivers

Internal measures External measures

Quantitative measures Qualitative measures

3. Focused on what internal and external stakeholders want from IA

External: Audit Committee, CHU Internal: Management, Clients, IA

4. Directly linked to the maturity level of the IA function.

Expand as the internal audit unit increases in maturity

• Qualitative performance measures

Creating strong and
are often based on data that needs to be
collected or derived, for example through effective KPIs
survey research or interviews. They offer
a broader view of performance on a
The IACOP considers that there are five
range of topics that can provide depth
distinct steps or elements involved in creating
to quantitative metrics.3
a strong and effective KPI. These elements are
outlined in Figure 2.
There is much evidence to suggest that KPIs
should expand in content and depth as the
internal audit function matures (see Figure 1).

3
IIA practice guide on Measuring Internal Audit Effectiveness and Efficiency, 2010

7
 Figure 2. Five elements of a strong KPI

Objective Indicator Data Target Reporting

A clear Indicator(s) Data collected A process to

(SMART) that measure to show A target value report on the
objective achievement whether the for successful achievement
or set of of the indicator is achievement of the
objectives objectives set being met indicator

The first element/step for all performance The third element/ step is to collect data to
measurement systems is to establish show the extent to which the indicator is
objectives that specify what the being met. Ideally, the data for quantitative
organizational entity – in this case internal indicators will be generated as a by-product
audit - is trying to achieve. These objectives of the planning, operational, and financial
must be SMART (Specific, Measurable, systems relating to the audit process. For
Achievable, Relevant, and Time-bound). qualitative indicators, however, additional
process to generate this data may be needed
The second element/step is to identify
- for example, the development, issue, and
indicators which measure whether those
review of survey questionnaires.
objectives are in fact being met. The
European Commission Internal Audit Service In all cases it is important to guard against
(IAS) uses the mnemonic RACER to measure the manipulation of the data collected – for
the effectiveness of an indicator: example, splitting one recommendation
into its constituent parts to better meet a
• Relevant (capable of measuring the
KPI on the proportion of recommendations
objective),
accepted.
• Accepted (by those being measured
and those who receive reports of the The fourth element is to set baselines and
measure), target achievement levels. A baseline is a
reference point against which to measure
• Credible (unambiguous and not overly
achievement or progress towards objectives
technical),
and assess if performance has improved. A
• Easy (to monitor), and KPI without a target, the ultimate desired
situation that is both quantified and timed,
• Robust (must monitor actual change).
will do little to influence future performance.

8
Milestones should be set for longer-term • The frequency of reports should also
targets. Internal audit should avoid the trap reflect stakeholder needs. For example:
of setting targets that are too easy to meet. senior managers may need a report
Targets should be updated in accordance once a year, audit committees may want
with the maturity of the internal audit a report for each meeting, the CHU may
function. expect a report in accordance with the
frequency of the reporting requirements
The final element is to ensure that there
by the internal audit function (but at least
is a process to collect and report on data
once a year), and internal audit managers
that shows whether the indicator has been
may be monitoring KPIs every month.
achieved or not:
• The format of the report should meet
• The type of reporting should vary to
readers’ expectations. Dashboards may be
meet the needs of different stakeholders
used to summarize data across a number
– what a senior manager needs to know
of indicators. A traffic light coding to
will be different from an audit committee.
identify the most critical information
should also be considered.

9
 Part 3. 10.

A balanced
11.

scorecard for
internal audit

Setting and measuring KPIs is intended A balanced scorecard for internal audit could
to influence the performance of internal include the four dimensions as shown in
auditors. However, if too few indicators Figure 3.
are used they may have unintended
The four dimensions represented in the
consequences. Good practice is therefore to
model above are:
develop a number or “basket” of indicators
that measure different aspects of internal • Internal stakeholders. These are the
audit performance and also reflect the senior and/or supervisory managers of
needs of different stakeholders. This is usually the entity where internal audit operates
referred to as a “balanced scorecard”. – normally the head of the institution in
which internal audit operates.

Figure 3. The Balanced Scorecard for Internal Audit

1
Internal
Stakeholders

4 2
Audit Added Value External
Clients Stakeholders

3
Internal
Auditors

10
• External stakeholders. These would Each of these stakeholder groups have
include an audit committee (if one exists) different requirements and/or interests in
and a body such as a CHU that has a role terms of the performance and perceived
in supporting/overseeing internal audit value of internal audit and may therefore
functions. The supreme audit institution require different KPIs. Some indicators
is also an external stakeholder in most may also be of relevance to more than one
PEMPAL countries. stakeholder.
• Internal auditors. The auditors and The possible performance indicators of
managers who work inside the internal interest to each stakeholder group in the
audit function. This is another subset of balanced scorecard are shown in tables 1 to
internal stakeholders who have specific 4 below.
needs in terms of more detailed KPIs
related to internal productivity (that may
appear less relevant in the eyes of other
stakeholders).
• Audit clients are a subset of internal
stakeholders who have specific
interactions with internal audit in relation
to audit engagements.

1
Table 1. Internal Stakeholders

Possible Performance
Comment
Indicators

Materiality of audit findings. Helps managers understand whether internal audit has
identified serious issues.

Percentage of unsatisfactory Measures how many audits result in poor or

ratings. unsatisfactory ratings. This may be an indicator of the
control maturity of the organization.

Percentage of the audit plan A low percentage may indicate that internal audit is
delivered during the year. taking on too many unplanned assignments. But it
could also indicate that internal audit is being agile in
responding to requests for assistance.

11
 Possible Performance
Comment
Indicators

Percentage of An indicator of the relevance, credibility, and quality of

recommendations internal audit work.
implemented by taking
corrective action.

Number of complaints from Provides an indication of areas that may have been
regulatory bodies. overlooked by internal audit. Plus the control maturity/
culture of the organization.

Number of frauds per annum The quantity of frauds and the total value of fraud
and the value of frauds. measure different aspects of fraud risks within the
organization.

Percentage of high-risk audit How far is internal audit covering the major areas of risk
universe covered each year. within the organization.

Percentage of internal May indicate that internal audit is developing

auditors being promoted high quality staff that are valued elsewhere in the
elsewhere in the organization.
organization.

Results of client satisfaction Provides senior managers with an indicator of how

survey questionnaire at the well internal audit is performing its individual audit
end of audit assignments. assignments.

Cost savings generated by Senior managers are interested in knowing to what

implementing internal audit extent internal audit recommendations result in cost
recommendations. savings across the organization.

Changes to processes Measures the level of process improvement generated

resulting from by internal audit.
implementing internal audit
recommendations.

12
 2
Table 2. External Stakeholders

Possible Performance
Comment
Indicators

Audit committee rating. An overall rating of the internal audit function provided
by the audit committee – this may be descriptive rather
than a rating within a scale.

Percentage of The proportion of recommendations accepted is a

recommendations accepted measure of the success of internal audit work.
or not.

Number of frauds per annum The quantity of frauds and the total value of fraud
and value of frauds. measure different aspects of fraud risks within the
organization.

Indicators of the These may be qualitative rather than quantitative for

independence of internal example the results of external quality assessments or
audit. CHU reviews, plus annual declaration by internal audit.

Percentage of high-risk audit How far is internal audit covering the major areas of risk
universe covered each year. within the organization.

Percentage of audit Measures whether internal audit is responding to the

assignments that respond needs of the audit committee.
directly to concerns raised by
the audit committee.

Results of client satisfaction

survey questionnaire at the
end of audit assignments.
Helps the audit committee to assess the level of
satisfaction from senior management.
Results of annual client
satisfaction survey of senior
managers.

Results of internal quality A critical indicator of the quality of audit work

assessments. undertaken by the internal audit function.

Results of periodic external The highest value indicator of the quality of internal
quality assessments. audit work.

13
 3
Table 3. Internal Audit Function

Possible Performance
Comment
Indicators

Percentage of audits May indicate there is too much unplanned work.

completed versus those
planned.

The elapsed time for A general indicator of the overall efficiency of the audit.
completing an audit from
start to finish.

The mean or average time A good measure of efficiency in the report writing
from a closing meeting to process which in turn indicates that the audit was well
issuing the audit report. planned to generate the evidence needed.

Percentage of annual audit Looks at how good an audit unit is at managing costs.
costs versus annual budget.

Number of years of relevant A useful indicator of the level of required business

business experience across expertise.
all staff.

Number of years of audit A useful indicator of the level of direct audit experience.
experience across all staff.

The percentage of certified A good indicator of the level of trained auditors.

auditors.

Percentage of planned and

High levels of turnover may be an indication of staffing
unplanned staff turnover
problems in the unit.
during the year.

Number of training hours per Measures the extent to which auditors are meeting
auditor per year. continuing professional development expectations.
This is also an indicator of the priority internal audit
gives to training.

Number of innovative An indicator of whether the internal audit unit is

improvements. regularly reviewing its own processes.

14
 4
Table 4. Audit Clients

Possible Performance
Comment
Indicators

Satisfaction survey rating. May indicate satisfaction or problems with individual

assignments or managers.

Percentage of issues that are May indicate that managers are not taking sufficient
open, closed, or past due. action to address recommendations raised by internal
audit.

Percentage of May indicate that internal audit is not selling their

recommendations accepted findings to clients well.
or not.

Number of repeat findings. May indicate that systemic weaknesses are not being
addressed.

Number of requests by May indicate that clients are seeking out internal audit
local management for audit help and value their services.
support.

15