Five Tips: How to measure the value of your internal audit department By Connie Valencia CIA, CCSA, principal with Elevate Consulting and Gaurav Kapoor COO with MetricStream Measuring the performance of an organisational process is second nature to internal auditors. But measuring the performance of the internal audit department is a different ball game altogether. Are you measuring your department s performance? What are the Key Performance Indicators (KPIs) you should use? Perhaps we should start off with a more fundamental question: why is it important to measure the performance of the internal audit function? To answer that, take a look around your organisation. In these tough economic times, everyone is under more pressure than ever before to add value to the organisation. Each department has to demonstrate its worth, and Internal Audit is no different. A Chief Audit Executive (CAE) who can show in measurable detail how his/her department impacts the organisation has a greater chance of securing audit budgets and getting audit plans approved. Here are five tips on how to measure the value of the internal audit department: TIP 1: GO BEYOND TRACKING HOURS If you come from the public accounting world, you re probably used to tracking audit hours. However, reporting audit hours as a ratio of staff utilisation is far more insightful information. Utilisation is calculated as follows: Annual Audit hours Total annual work hours (including vacation, training, admin, etc) Indicating the percentage of audit field work hours applied to the total annual hours is far more valuable to your stakeholders than just reporting the number of audit hours. The pie chart below tracks the staff utilisation in an internal audit department consisting of the Director of Internal Audit and a senior auditor. A total of 3,680 hours are allotted to the department every year. Out of this, 2,598 hours are spent on auditing, while the remaining hours are spent on training, planning/admin, and Paid Time Off (PTO). Therefore, the total percentage of time spent on auditing each year is 71% (i.e. 2,598/3,680).
Go Beyond Tracking Hours Try comparing the utilisation of auditors against each audit s percentage of completion, as well as the overall percentage of audits completed. When analysed together, you should be able to identify if your team is spinning or if there has been a scope creep in one of your audits, requiring interception. If benchmarking is an important priority in your organisation, consider investing in the Institute of Internal Auditors (IIA) GAIN Report. The GAIN Report is tailored to your industry using surveyed data. It provides helpful analytics for comparing the suggested number of auditors against the number of total employees, identifying the number of auditors per revenue/ asset, etc. Alternatively, you could try conducting local CAE roundtables to benchmark easy statistics such as department utilisation. Your audit infrastructure plays a major role in measuring and improving department utilisation. An advanced resource management tool, for instance, will help you quickly identify the number of available auditors, track their competencies, and efficiently allocate audit assignments. The tool typically maintains all auditor details and profiles in a centralised framework for easy search and reference. A time-tracking tool will help you accurately capture the time spent in auditing, thereby facilitating optimal resource utilisation. Another useful tool is a risk assessment application which can help you identify and prioritise risks across the enterprise. The result is a more targeted and value-focused audit plan. TIP 2: MEASURE QUALITY You can t measure what you don t monitor. This is very true when it comes to such an esoteric metric like quality. How do you measure quality? Well, first we start by asking, how do we define the quality that Internal Audit provides to the organisation? The most obvious indicator of quality lies in the number of times the Management has requested internal audit s services. What kinds of special requests do you receive from the Management? Fraud investigations, project management, IT advisory, policy procedures,
or process improvement efforts? Begin with defining how internal audit provides value to the organisation. Once you ve defined quality, then you can begin monitoring and measuring it. Here s how you do that: Track the number of times the Management has requested Internal Audit s assistance. Take this metric to the next level and track the average response time to the Management s request: from initial request, to the start of fieldwork, to the completion of the final project. Turn-aroundtime (TAT) is a widely accepted metric that is homogenous to any process. TAT indicates the efficiency rate as well as the optimisation of the department s utilisation. You could indirectly measure the quality of internal audits by quantifying the average level of customer satisfaction. Sending out customer satisfaction surveys is a great way to promote transparency and an open door policy. You may also consider tracking the number of complaints. You don t have to report these numbers, but when it comes to your audit department, it s always good to know the good and the bad. 1st Qtr 2nd Qtr 3rd Qtr 4th Qtr Number of Management Requests 3 1 2 4 Average Response Time < Month 1 month 1 month 2 months Average Client Satisfaction (scale 1-5) 3 4 4 5 Number of Complaints about Audits 1 0 0 0 Measure Quality Another great hit em between the eyes metric is calculating the financial impact of the quality your department delivers. You can do this by determining the internal audit department s return on investment (ROI). First, divide your department s functions into various categories: compliance, IT audits, operational audits, special projects (i.e. advisory services), administration, etc. Track how many hours are spent, per auditor, on each of these functions. Then, compare the hours, per auditor, to the salaries of the auditors in these functions. For example, consider the following data: Percentage of Time Spent on Activities Position Salary Compliance Special Projects Operational Audits Special Audits Administrative Audit Dir 100,000 10% 10% 10% 10% 60% Audit Mgr 65,000 15% 35% 15% 25% 10% Audit Sr 55,000 50% 0% 50% 0% 0%
Graphically, the ROI is calculated as shown in the following Diagrams 3,000 2,250 1,500 750 0 2011 IA Actual Hours Incurred Compliance Special Projects Operational Special Audits Admininstrative $70,000 $52,500 $35,000 $17,500 $0 Allocation of IA Salary by Project Compliance Special Projects Operational Special Audits Admininstrative Allocation of Hours Incurred by Project Allocation of IA Salary by Project According to the above analysis, the lowest value audit function (i.e. administration) has the highest salary allocation as well as the highest number of hours incurred each year. Hopefully, your audit department is demonstrating a higher ROI by spending more time on functions other than administration. TIP 3: EVALUATE YOUR SKILLS Here s your chance to really demonstrate the talent, institutional knowledge, and technology within your internal audit department. Quantify your team s audit skills by: tracking the average number of years of audit experience; the number of annual hours of training per auditor; the number of certifications held by your staff; the tenure each member has with the company/ industry; etc. Some departments have rotating programmes where auditors, after a certain period of time, roll into operations at the managerial level. Try tracking the number of staff who have been successful with the rotational programme, trained by internal audit, and rolled out into operations. This way you can demonstrate how your department produces some of the organisation s best and brightest talent within the Management.
KPI Director Senior Average Years of Audit Experience 11 4 Annual Hours of Training per Auditor 53 40 Percentage of Training Achieved 133% 100% Certification (CPA, CIA, CISA) CPA, CIA CISA, CIA Tenure with Company (Years) 4 years 2 years Staff Rotated to and From Operations NA NA Staff Upwards Feedback Survey 5 NA Evaluate Your Skills TIP 4: SHOW THEM THE MONEY Every Chief Financial Officer (CFO) loves to see recommendations from the internal audit department for cost savings, expense reduction, and cost containment. However, if your department is more compliancedriven and can t quantify the cost savings per audit, then demonstrate the number of major compliance findings. Map these findings to the number of recommendations accepted by the Management. According to the type of recommendation, you could also assign a value driver (e.g. risk management, fraud, process improvement, compliance). In the chart below, two major risk related findings were identified in the first quarter. The recommendations made by the auditors were accepted and implemented by the Management, thereby reducing the risk to an acceptable level.
Director Senior KPI % Number of Auditors per 500 employees 1.0 1 100% Number of Auditors per $1.5B Assets 1.0 1 80% Staff Utilisation (Audit verses non Audit hours) 69% 85% Completed Audits / Reviews Per Auditor 6 10 Planned Audits for Period 3 8 Percentage of Budget Hours Incurred 60% 60% Show Them the Money To efficiently analyse audit findings and provide valuable recommendations, it is important to have a standardised audit process and methodology across the enterprise. An integrated audit infrastructure plays an important role by streamlining the entire audit lifecycle, and consolidating enterprise-wide audit findings in a centralised framework. It also transcends restrictive organisational silos, improving collaboration and team work on complex audit processes. A centralised, electronic workpaper management tool helps you harmonise and standardise the recording and rating of audit findings. Thus, you eliminate data inconsistencies and redundancies. Ensure that you have advanced dashboards to help you track the status of the audit, and compare it against predetermined milestones to measure progress and productivity. Another way to measure productivity in terms of cost is to track the number of auditors against the recommended number of employees per industry standard (this is where the GAIN report comes in handy). Also, consider listing the utilisation percentages for the audit department to show how hard your auditors are working. Try tracking the number of audits that were completed for the period vs the number of audits that were planned/ budgeted for. Based on where you are in the audit calendar, you might want to show if the audit department is working overtime, or is on schedule with the budgeted amount of hours to date. TIP 5: IT ALL COMES DOWN TO THE FINISH (AN OLD CARPENTER S RULE) In the end, the audit report is the proof of your work, the most visible document of the audit engagement. So how knowledgeable is this report? Before you issue your report, look at the number of meetings that your auditors have had with auditees (clients and stakeholders). Examine the content of the meetings. Ask yourself if the client has understood the objectives of the audit, its scope, and of course, its findings. Make sure that those findings have been validated by the client. Otherwise, you could end up with errors in data, causing you to lose all credibility forever.
Ensure that your audit report has a list of the recommendations implemented. Ask yourself Will my report hit my stakeholders between the eyes? Will they immediately realize the point to the report? A good rule of thumb is to ensure that at the beginning of the report, you ve addressed the following: The importance of the audit (i.e. why does this audit matter?) The creation of a sense of urgency (i.e. the desire to address the audit findings) Failing to address these two critical points immediately in your audit report, may put the report and you at the risk of disengaging your stakeholders. While the audit report is the single most important evidence of your value to the organisation, it can be extremely complex to prepare. Most companies use manual reporting processes that are cumbersome and time-consuming. Try replacing them with an automated reporting tool that automatically incorporates audit findings and analyses in predefined reporting templates. You could save a lot of time, effort, and resources this way. Simplify your audit reporting process by making it more streamlined, structured, and standardised through the use of integrated analytics and reporting tools. These tools will help you gain quick and easy access to audit data, summarise results and observations, and highlight critical information. As audit requests become more ad hoc and frequent, it is important to facilitate real-time visibility into audit data across the enterprise. Executive dashboards provide top-level visibility for CAEs to track the status of audits, as well as the implementation of corrective actions and recommendations. They also provide valuable risk insights and intelligence, advanced GRC analytics, what-if scenarios, and other operational metrics which are crucial for making decisions and defining audit strategies. ADDITIONAL WAYS TO ADD VALUE TO THE ORGANISATION Be the second set of eyes for the Chief Accounting Officer. Put your CPAs in your team to work, and have them act as advisors on how to treat complex accounting transactions. Act as a project manager (assuming your organisation does not have a PMO in place), and help keep the IT department working on time and within budget for major IT projects. When performing audits, look for business process automation opportunities that can contain costs and improve efficiencies. Research industry-specific vendors, and incorporate valuable industry benchmarks and best practices into your audit recommendations. Above all, remain relevant. Stay up-to-date on the changes and impact of technology, accounting guidance, and regulatory guidance on your industry. To be a successful internal auditor, you need to be the master of all areas of your business triangle: people, processes, and technology. Don t view your department simply as a compliance shop. Put on your advisory hat and start thinking creatively. The good news is that as an auditor, you know where the problems are. So be a part of the solutions, and incorporate benchmarks and best practices into your recommendations. The only constant in business today is change. Inflexible auditors that cannot adapt to change will become obsolete, and your department will lose credibility and value. CONCLUSION By applying the tips mentioned throughout this article, you should be able to quantifiably measure the value added by your internal audit department. Ultimately, you should run your department based on measureable data. Follow your own instincts on how to effectively use data and transform it into valuable information. Monitor your own KPIs. And as always, continue to add value to your clients businesses.