Setting Performance Indicators and Targets for the Internal Audit Function (CIA Part 3)
Overview
Setting performance indicators and targets is a core part of managing the quality of the internal audit function. It falls within the CIA Part 3 domain on managing the internal audit activity. The Chief Audit Executive (CAE) must show stakeholders that internal audit is effective, efficient and adds value. Performance indicators (often called KPIs or performance measures) and their targets are the tools used to show this, and to drive continuous improvement.
Why It Is Important
Performance indicators matter for several reasons:
1. Accountability: The board and senior management need objective evidence that internal audit is meeting its mandate and using its resources well.
2. Alignment with the Standards: The IIA's Global Internal Audit Standards (and the earlier IPPF Standard 1300, the Quality Assurance and Improvement Program) require the CAE to:
- develop a performance measurement methodology;
- monitor performance against objectives;
- report results to the board.
Under the 2024 Standards, Principle 12 (Enhance Quality) requires internal audit to evaluate its performance and report on it. Standard 12.2 covers performance measurement.
3. Value demonstration: Good metrics turn audit activity into outcomes stakeholders understand, such as risks reduced, controls improved and savings identified.
4. Continuous improvement: Targets show where performance falls short and where training, process changes or resources are needed.
5. Resource justification: Metrics support budget and staffing requests.
6. Strategic alignment: Indicators link audit work to organizational strategy and the internal audit strategic plan.
What It Is
Key terms:
- A performance indicator is a quantitative or qualitative measure used to judge how well internal audit achieves its objectives.
- A target is the specific level of performance expected for an indicator over a set period. For example, '90% of the audit plan completed by year-end.'
- A benchmark is an external or historical reference point used to set or judge targets.
Indicators usually fall into these categories:
- Input measures: resources used, such as budget, staff hours, staff certifications and training hours per auditor.
- Process (activity) measures: efficiency of audit work, such as cycle time from fieldwork to report issuance, percentage of the audit plan completed, and budget-to-actual hours.
- Output measures: products delivered, such as the number of reports issued and the number of recommendations made.
- Outcome (impact) measures: value added, such as the percentage of recommendations accepted and implemented, cost savings identified, reduced loss events, and stakeholder satisfaction scores.
A common framework is the Balanced Scorecard adapted for internal audit. It typically has four perspectives:
- Stakeholder/Customer: board and management satisfaction survey scores, and the extent to which key concerns are addressed.
- Internal Processes: plan completion, timeliness of reports, and conformance with the Standards.
- Innovation and Learning: CPE hours, certifications (CIA, CISA), and use of data analytics.
- Financial/Efficiency: cost per audit, budget variance, and value of savings identified.
How It Works: The Process
Step 1: Understand stakeholder expectations. The CAE consults the board, the audit committee and senior management to learn what success looks like. Expectations differ: the audit committee may focus on assurance coverage of key risks, while operational managers may focus on timeliness and practical recommendations.
Step 2: Link to the internal audit strategy and charter. Indicators must reflect the mission, the charter and the strategic plan. If the strategy emphasizes advisory services or technology, the indicators should reflect that.
Step 3: Select balanced indicators. Use a mix of quantitative and qualitative measures, covering efficiency and effectiveness, and leading and lagging measures. Avoid relying only on output counts such as the number of audits completed.
Step 4: Apply SMART criteria. Each indicator and target should be:
- Specific: clearly defined;
- Measurable: data is available;
- Achievable: realistic given resources;
- Relevant: linked to objectives;
- Time-bound: has a defined period.
Step 5: Set targets. Base targets on:
- historical performance;
- benchmarking against peers (for example, IIA research or GAIN-type benchmarking studies);
- stakeholder expectations;
- available resources.
Targets should stretch performance without encouraging behavior that hurts audit quality.
Step 6: Obtain approval and agreement. Discuss the indicators and targets with the board or audit committee, and ideally get their approval as part of the internal audit plan or QAIP.
Step 7: Collect data and monitor. Use audit management software, time-tracking systems, post-engagement client surveys and recommendation follow-up databases.
Step 8: Report results. Report performance to senior management and the board regularly, for example quarterly, often through a dashboard. Explain significant variances and corrective actions.
Step 9: Review and revise. Reassess indicators at least annually so they stay relevant as risks, strategy and stakeholder needs change.
Examples of Common Internal Audit KPIs
- Percentage of the approved audit plan completed: target, for example, 90% or more.
- Average days from fieldwork end to final report: target, for example, 30 days or fewer.
- Percentage of management action plans implemented by the agreed date: target, for example, 85%.
- Post-audit client satisfaction score: target, for example, 4 out of 5 or higher.
- Percentage of staff holding professional certifications.
- Training hours per auditor per year: target, for example, 40 hours or more.
- Percentage of audit hours spent on high-risk areas.
- Results of internal and external quality assessments, showing conformance with the Standards.
- Budget versus actual hours per engagement: variance within plus or minus 10%.
Pitfalls to Avoid
- Measuring what is easy rather than what matters. Counting audits completed says little about value added.
- Perverse incentives. Over-emphasizing speed or recommendation acceptance can lead to rushed work or diluted findings, which threatens objectivity and quality.
- Too many indicators. These confuse stakeholders. A focused set of about 8 to 12 key measures is usually best.
- Measuring only internally. Leaving out stakeholder feedback misses perceived value.
- Static targets. Targets that are never revisited lose relevance.
Relationship to the QAIP
Performance measurement is part of ongoing monitoring within the Quality Assurance and Improvement Program. KPIs work alongside periodic self-assessments and external quality assessments, which must occur at least once every five years. KPIs show how well the function is operating. Quality assessments test conformance with the Standards. Both are reported to the board.
Exam Tips: Answering Questions on Setting Performance Indicators and Targets
1. Prioritize stakeholder alignment. When asked what the CAE should do first, the answer is usually to identify stakeholder expectations and link indicators to the internal audit strategy and organizational objectives.
2. Outcome beats output. If a question asks for the best measure of internal audit value or effectiveness, pick outcome measures (recommendations implemented, risk reduction, stakeholder satisfaction) over activity counts (number of audits or reports issued).
3. Distinguish efficiency from effectiveness.
- Efficiency means resource use, such as hours versus budget and cycle time.
- Effectiveness means achieving objectives and adding value, such as the quality of findings and implementation rates.
Read carefully which one the question targets.
4. Remember the board's role. The board or audit committee should approve or be informed of performance measures and receive regular reports. Choices suggesting the CAE keeps metrics only internally are usually wrong.
5. Watch for threats to objectivity. Reject answers where targets could compromise independence or quality, such as bonuses tied to management's satisfaction with audit findings, or quotas for the number of findings.
6. Know the balanced scorecard perspectives. Be ready to classify a metric. For example, CPE hours fall under learning and growth, and the client survey score falls under stakeholder.
7. Apply SMART logic. When choosing the best-defined target, choose the one that is specific, measurable and time-bound. 'Complete 95% of the plan by December 31' beats 'improve audit coverage.'
8. Benchmarking is valid but not sufficient. Targets should reflect the organization's own context and risks. Peer benchmarks are a useful reference, not an automatic standard.
9. Link to the QAIP. Recognize that KPIs support ongoing monitoring. Questions may test whether KPIs replace external assessments. They do not.
10. Use scenario reasoning. Suppose implementation rates are low. The best response is to analyze root causes, such as unrealistic recommendations, management resistance or weak follow-up, and report to the board. Lowering the target or stopping measurement are not good responses.
11. Eliminate extremes. Options using words like 'only,' 'always' or 'solely' (for example, 'measure performance solely by cost savings') are usually incorrect. Balanced, multi-dimensional answers tend to be correct.
Quick Practice Example
Question: Which of the following is the most appropriate indicator of the value internal audit adds to the organization?
A. Number of audit engagements completed
B. Percentage of audit recommendations implemented by management
C. Total audit hours charged
D. Number of staff in the audit department
Answer: B. It is an outcome measure that reflects real improvement in governance, risk management and control. A and C are activity or output measures, and D is an input measure.
Summary
Setting performance indicators and targets lets the CAE show and improve the quality and value of internal audit. Effective metrics should:
- be aligned with stakeholder expectations and strategy;
- balance efficiency, effectiveness, inputs and outcomes;
- follow SMART principles;
- be approved by and reported to the board;
- be reviewed regularly as part of the QAIP.
In the exam, favor answers that emphasize value-focused outcomes, board oversight, objectivity and continuous improvement.
