Qualitative and Quantitative Performance Measures for the Internal Audit Function (CIA Part 3)
Introduction
Within the CIA Part 3 syllabus, the topic Quality of the Internal Audit Function asks how the chief audit executive (CAE) shows that internal audit is effective, efficient and adds value. To do that, the CAE needs evidence of how well the function performs. That evidence comes from performance measures, also called key performance indicators (KPIs). They fall into two broad groups:
1. Quantitative measures are numeric.
2. Qualitative measures are descriptive or judgment-based.
This guide covers why these measures matter, what they are, how they work in practice, and how to handle exam questions on them.
1. Why Performance Measures Are Important
Accountability to the board and senior management. Internal audit uses organizational resources. The board (often through the audit committee) needs assurance that the function is delivering on its charter and approved plan. Performance measures make that delivery visible.
Support for the Quality Assurance and Improvement Program (QAIP). The IIA Standards require the CAE to develop and maintain a QAIP covering all aspects of the internal audit activity. The QAIP includes:
• Ongoing monitoring, which relies heavily on routine performance metrics.
• Periodic self-assessments.
• External assessments.
Performance measures are a core input to ongoing monitoring and to reporting QAIP results to senior management and the board.
Continuous improvement. Measures show trends, weaknesses and training needs. This allows the CAE to adjust staffing, methodology, technology and the audit plan.
Demonstrating value. Stakeholders increasingly expect internal audit to be a strategic partner. Metrics show that it contributes to risk management, control and governance, beyond simply producing reports.
Alignment with strategy. Under the Global Internal Audit Standards (2024), the CAE must develop an internal audit strategy and a performance measurement methodology. Measures link daily activity to the function's strategic objectives.
2. What Performance Measures Are
A performance measure is a defined indicator used to assess how well the internal audit activity achieves its objectives. A useful framework is to evaluate performance across several dimensions, much like a balanced scorecard:
• Stakeholder or client perspective: satisfaction, value added, relationship quality.
• Internal process perspective: efficiency, timeliness, compliance with standards.
• Innovation and capabilities (learning and growth) perspective: staff competence, training, certifications, technology use.
• Board or audit committee perspective: coverage of key risks, quality of reporting, achievement of the plan.
A. Quantitative Performance Measures
These are objective, numeric and countable. They are easy to track, benchmark and trend over time. Examples include:
• Percentage of the audit plan completed.
• Number of audits completed versus planned.
• Actual versus budgeted hours per engagement (budget variance).
• Cycle time, such as days from fieldwork end to final report issuance.
• Number of recommendations issued.
• Percentage of recommendations accepted or implemented by management.
• Percentage of overdue corrective actions.
• Cost savings or recoveries identified.
• Average post-audit survey score (a numeric score built on qualitative perceptions).
• Training hours per auditor, and percentage of staff holding professional certifications (CIA, CPA, CISA).
• Staff turnover and vacancy rates.
• Percentage of high-risk areas covered by the plan.
• Number of repeat findings.
Strengths: objective, easy to compare across periods and organizations, and simple to report in dashboards.
Weaknesses: they can encourage the wrong behavior (for example, issuing many trivial recommendations to raise counts, or rushing work to meet deadlines). They often measure activity rather than value, and they do not capture insight or influence.
B. Qualitative Performance Measures
These are subjective, judgment-based or descriptive. They capture the quality, relevance and impact of internal audit work. Examples include:
• Stakeholder satisfaction expressed through comments, interviews and feedback.
• Audit committee and senior management perceptions of the value added.
• Quality of audit reports: clarity, concision, constructiveness, and focus on root causes.
• Results of internal quality reviews (supervisory and peer reviews of workpapers).
• Results of external quality assessments, including conformance conclusions such as generally conforms, partially conforms or does not conform.
• Strength of relationships and the function's reputation as a trusted advisor.
• Usefulness of insights and recommendations in addressing significant risks.
• Professionalism, objectivity and communication skills of auditors.
• Degree of alignment of the audit plan with organizational strategy and risks.
Strengths: they capture value, impact, relevance and stakeholder perception, which are the things numbers miss.
Weaknesses: they are subjective, harder to compare and benchmark, and prone to bias. For example, auditees who received unfavorable findings may rate the function poorly.
C. The Need for a Balance
The best practice, and the answer the CIA exam usually rewards, is a balanced combination of qualitative and quantitative measures. Reliance on numbers alone may emphasize efficiency over effectiveness. Reliance on perception alone lacks objectivity. Together they give a complete picture of efficiency, effectiveness and value.
3. How Performance Measurement Works in Practice
Step 1: Link to the charter, strategy and stakeholder expectations. The CAE identifies what success looks like by consulting the board, senior management and other stakeholders.
Step 2: Select relevant KPIs. The CAE chooses a manageable set of qualitative and quantitative measures across the perspectives above. Good KPIs are SMART: specific, measurable, achievable, relevant and time-bound.
Step 3: Set targets and baselines. Examples: 90% plan completion; reports issued within 30 days of fieldwork; average satisfaction score of 4 out of 5.
Step 4: Gather data. Sources include:
• Audit management software for hours, cycle times and issue tracking.
• Post-engagement surveys.
• Audit committee feedback.
• Supervisory reviews.
• Self-assessments.
• External quality assessments.
Step 5: Analyze and interpret. The CAE compares results with targets, prior periods and benchmarks (for example, IIA industry benchmarking data). Results should be interpreted in context. A low plan completion rate may reflect justified plan changes in response to emerging risks.
Step 6: Report. The CAE communicates performance and QAIP results to senior management and the board, typically periodically and at least annually.
Step 7: Act and improve. The CAE uses findings to drive action plans, such as training, methodology updates, resourcing changes and technology investment.
Illustrative Example
A CAE's dashboard shows 95% plan completion and all reports issued on time. These are strong quantitative results. However, audit committee interviews reveal that members find reports too long and focused on minor control issues rather than strategic risks. This is a weak qualitative result. The combined picture shows an efficient function that is not yet adding maximum value. The improvement action is to refocus the plan on key risks and restructure reports with executive summaries.
Common Pitfalls
• Measuring too many things, which creates noise.
• Measuring only inputs and outputs (hours, number of reports) rather than outcomes (risk reduction, implemented improvements).
• Metrics that compromise independence or objectivity, such as tying auditor bonuses to auditee satisfaction scores.
• Failing to act on results.
4. How to Answer Exam Questions on This Topic
CIA Part 3 questions on this area usually take one of these forms:
Type 1: Classification. Which of the following is a qualitative measure? Determine whether the measure is a count, percentage, time or amount (quantitative) or a judgment, opinion or description of quality (qualitative). A numeric survey score is usually treated as quantitative, while narrative feedback is qualitative. Read carefully.
Type 2: Best measure of effectiveness or value added. Effectiveness and value are best reflected by outcome-oriented measures. Examples are the percentage of recommendations implemented, the reduction in repeat findings, and audit committee or senior management assessments of value. Pure activity counts, such as the number of audits performed, measure efficiency or output rather than effectiveness.
Type 3: Best measure of efficiency. Look for measures relating resources to output: actual versus budgeted hours, cycle time, and cost per audit.
Type 4: Limitations or risks of a measure. Recognize dysfunctional incentives:
• Counting recommendations may encourage trivial findings.
• Satisfaction surveys may be biased by unfavorable results.
• Deadline metrics may sacrifice quality.
Type 5: Scenario questions. These involve a CAE designing a QAIP or reporting to the audit committee. The correct answer typically involves a balanced set of measures aligned with stakeholder expectations and strategy, reported to the board.
Exam Tips: Answering Questions on Qualitative and Quantitative Performance Measures
Tip 1: Use the key distinction. Quantitative means numbers, counts, percentages, time and money. Qualitative means perceptions, judgments, quality and narrative. When torn, ask: Can this be objectively counted without judgment?
Tip 2: Prefer balance. If an option says the CAE should use a combination of qualitative and quantitative measures, it is very often correct. Be wary of answers that rely solely on one type.
Tip 3: Match the measure to the objective.
• Efficiency calls for time, cost and budget variance measures.
• Effectiveness and value call for implemented recommendations, risk coverage and stakeholder assessments.
• Capability calls for training, certifications and skills.
Tip 4: Treat the audit committee or board's view as a key indicator. Board and senior management satisfaction and their perception of value are among the most important indicators of internal audit's success. They are often the best answer to most meaningful or best indicator of value questions.
Tip 5: Watch for activity traps. Options such as number of audit reports issued or number of findings measure activity, not quality. They are rarely the best indicator of effectiveness.
Tip 6: Connect to the QAIP. Performance metrics feed ongoing monitoring. External assessments occur at least once every five years. Results of the QAIP are communicated to senior management and the board.
Tip 7: Protect independence and objectivity. Reject answers in which performance measures could impair objectivity. An example is linking auditor compensation to auditee ratings or to the volume of findings.
Tip 8: Read qualifiers carefully. Words such as best, most likely, primary and least useful change the answer. Several options may be valid measures, but only one best fits the stated purpose.
Tip 9: Remember context matters. A drop in plan completion is not automatically bad if the plan was appropriately revised for emerging risks with board approval. Look for answers showing professional judgment.
Tip 10: Use benchmarking wisely. Comparing metrics with peers or industry data is useful. The best answer usually emphasizes that measures should first align with the organization's own objectives and stakeholder expectations.
Quick Recap
• Performance measures show whether internal audit is efficient, effective and adding value, and they underpin the QAIP.
• Quantitative measures are objective and comparable but may miss value and can drive the wrong behavior.
• Qualitative measures capture impact and perception but are subjective.
• Best practice is a balanced, strategy-aligned set of KPIs, reported to senior management and the board and used for continuous improvement.
• In the exam, classify carefully, match the measure to the objective, favor balance and outcome-focused measures, and protect independence.
