Five Tips: How to measure the value of your internal audit department

By Connie Valencia CIA, CCSA, principal with Elevate Consulting and Gaurav Kapoor COO with
MetricStream
Measuring the performance of an organisational process is second nature to internal auditors. But
measuring the performance of the internal audit department is a different ball game altogether.
should use? Perhaps we should start off with a more fundamental question: why is it important to measure
the performance of the internal audit function?
To answer that, take a look around your organisation. In these tough economic times, everyone is under
worth, and Internal Audit is no different. A Chief Audit Executive (CAE) who can show in measurable
detail how his/her department impacts the organisation has a greater chance of securing audit budgets and
getting audit plans approved.
Here are five tips on how to measure the value of the internal audit department:
TIP 1: GO BEYOND TRACKING HOURS
reporting audit hours as a ratio of staff utilisation is far more insightful information. Utilisation is
calculated as follows:
Annual Audit hours
__________________________________________________________
Total annual work hours (including vacation, training, admin, etc)
Indicating the percentage of audit field work hours applied to the total annual hours is far more valuable
to your stakeholders than just reporting the number of audit hours.
The pie chart below tracks the staff utilisation in an internal audit department consisting of the Director of
Internal Audit and a senior auditor. A total of 3,680 hours are allotted to the department every year. Out of
this, 2,598 hours are spent on auditing, while the remaining hours are spent on training, planning/admin,
and Paid Time Off (PTO). Therefore, the total percentage of time spent on auditing each year is 71% (i.e.
2,598/3,680).
Originally published on Auditandrisk.org.uk in August 2012. Not to be reprinted without permission.
Go Beyond Tracking Hours
Try comparing the utilisation of auditors against each audits percentage of completion, as well as the
overall percentage of audits completed. When analysed together, you should be able to identify if your
team is spinning or if there has been a scope creep in one of your audits, requiring interception.
If benchmarking is an important priority in your organisation, consider investing in the Institute of
Internal Auditors (IIA) GAIN Report. The GAIN Report is tailored to your industry using surveyed data.
It provides helpful analytics for comparing the suggested number of auditors against the number of total
employees, identifying the number of auditors per revenue/ asset, etc. Alternatively, you could try
conducting local CAE roundtables to benchmark easy statistics such as department utilisation.
Your audit infrastructure plays a major role in measuring and improving department utilisation. An
advanced resource management tool, for instance, will help you quickly identify the number of available
auditors, track their competencies, and efficiently allocate audit assignments. The tool typically maintains
all auditor details and profiles in a centralised framework for easy search and reference.
A time-tracking tool will help you accurately capture the time spent in auditing, thereby facilitating
optimal resource utilisation. Another useful tool is a risk assessment application which can help you
identify and prioritise risks across the enterprise. The result is a more targeted and value-focused audit
plan.
TIP 2: MEASURE QUALITY
You cant measure what you dont monitor. This is very true when it comes to such an esoteric metric
like quality. How do you measure quality? Well, first we start by asking, how do we define the quality
that Internal Audit provides to the organisation? The most obvious indicator of quality lies in the number
of times the Management has requested internal audits services. What kinds of special requests do you
receive from the Management? Fraud investigations, project management, IT advisory, policy procedures,
Originally published on Auditandrisk.org.uk in August 2012. Not to be reprinted without permission.
or process improvement efforts? Begin with defining how internal audit provides value to the
organisation. Once youve defined quality, then you can begin monitoring and measuring it.
Heres how you do that: Track the number of times the Management has requested Internal Audits
assistance. Take this metric to the next level and track the average response time to the Managements
request: from initial request, to the start of fieldwork, to the completion of the final project. Turn-around-
time (TAT) is a widely accepted metric that is homogenous to any process. TAT indicates the efficiency
rate as well as the optimisation of the departments utilisation.
You could indirectly measure the quality of internal audits by quantifying the average level of customer
satisfaction. Sending out customer satisfaction surveys is a great way to promote transparency and an
open door policy. You may also consider tracking the number of complaints. You dont have to report
these numbers, but when it comes to your audit department, its always good to know the good and the
bad.
1st Qtr 2nd Qtr 3rd Qtr 4th Qtr
Number of Management Requests 3 1 2 4
Average Response Time < Month 1 month 1 month 2 months
Average Client Satisfaction (scale 1-5) 3 4 4 5
Number of Complaints about Audits 1 0 0 0
Measure Quality
Another great hit em between the eyes metric is calculating the financial impact of the quality your
department delivers. You can do this by determining the internal audit departments return on investment
(ROI). First, divide your departments functions into various categories: compliance, IT audits,
operational audits, special projects (i.e. advisory services), administration, etc. Track how many hours are
spent, per auditor, on each of these functions. Then, compare the hours, per auditor, to the salaries of the
auditors in these functions.
For example, consider the following data:
Percentage of Time Spent on Activities Percentage of Time Spent on Activities Percentage of Time Spent on Activities Percentage of Time Spent on Activities Percentage of Time Spent on Activities
Position Salary Compliance Special
Projects
Operational
Audits
Special
Audits
Administrative
Audit Dir 100,000 10% 10% 10% 10% 60%
Audit Mgr 65,000 15% 35% 15% 25% 10%
Audit Sr 55,000 50% 0% 50% 0% 0%
Originally published on Auditandrisk.org.uk in August 2012. Not to be reprinted without permission.
Graphically, the ROI is calculated as shown in the following Diagrams
Allocation of Hours Incurred by Project Allocation of IA Salary by Project
According to the above analysis, the lowest value audit function (i.e. administration) has the highest
salary allocation as well as the highest number of hours incurred each year. Hopefully, your audit
department is demonstrating a higher ROI by spending more time on functions other than administration.
TIP 3: EVALUATE YOUR SKILLS
Heres your chance to really demonstrate the talent, institutional knowledge, and technology within your
internal audit department. Quantify your teams audit skills by: tracking the average number of years of
audit experience; the number of annual hours of training per auditor; the number of certifications held by
your staff; the tenure each member has with the company/ industry; etc.
Some departments have rotating programmes where auditors, after a certain period of time, roll into
operations at the managerial level. Try tracking the number of staff who have been successful with the
rotational programme, trained by internal audit, and rolled out into operations. This way you can
demonstrate how your department produces some of the organisations best and brightest talent within the
Management.
0
750
1,500
2,250
3,000
2011 IA Actual Hours Incurred
Compliance
Special Projects
Operational
Special Audits
Admininstrative
$0
$17,500
$35,000
$52,500
$70,000
Allocation of IA Salary by Project
Compliance
Special Projects
Operational
Special Audits
Admininstrative
Originally published on Auditandrisk.org.uk in August 2012. Not to be reprinted without permission.
KPI Director Senior
Average Years of Audit
Experience 11 4
Annual Hours of Training per
Auditor 53 40
Percentage of Training Achieved133% 100%
Certication (CPA, CIA, CISA) CPA, CIA CISA, CIA
Tenure with Company (Years) 4 years 2 years
Sta! Rotated to and From
Operations NA NA
Sta! Upwards Feedback Survey 5 NA
Evaluate Your Skills
TIP 4: SHOW THEM THE MONEY
Every Chief Financial Officer (CFO) loves to see recommendations from the internal audit department for
cost savings, expense reduction, and cost containment. However, if your department is more compliance-
driven and cant quantify the cost savings per audit, then demonstrate the number of major compliance
findings. Map these findings to the number of recommendations accepted by the Management. According
to the type of recommendation, you could also assign a value driver (e.g. risk management, fraud,
process improvement, compliance).
In the chart below, two major risk related findings were identified in the first quarter. The
recommendations made by the auditors were accepted and implemented by the Management, thereby
reducing the risk to an acceptable level.
Originally published on Auditandrisk.org.uk in August 2012. Not to be reprinted without permission.
Director Senior KPI %
Number of Auditors per 500
employees 1.0 1 100%
Number of Auditors per $1.5B
Assets 1.0 1 80%
Sta! Utilisation (Audit verses non
Audit hours) 69% 85%
Completed Audits / Reviews Per
Auditor 6 10
Planned Audits for Period 3 8
Percentage of Budget Hours
Incurred 60% 60%
Show Them the Money
To efficiently analyse audit findings and provide valuable recommendations, it is important to have a
standardised audit process and methodology across the enterprise. An integrated audit infrastructure plays
an important role by streamlining the entire audit lifecycle, and consolidating enterprise-wide audit
findings in a centralised framework. It also transcends restrictive organisational silos, improving
collaboration and team work on complex audit processes.
A centralised, electronic workpaper management tool helps you harmonise and standardise the recording
and rating of audit findings. Thus, you eliminate data inconsistencies and redundancies. Ensure that you
have advanced dashboards to help you track the status of the audit, and compare it against predetermined
milestones to measure progress and productivity.
Another way to measure productivity in terms of cost is to track the number of auditors against the
recommended number of employees per industry standard (this is where the GAIN report comes in
handy).
Also, consider listing the utilisation percentages for the audit department to show how hard your auditors
are working. Try tracking the number of audits that were completed for the period vs the number of
audits that were planned/ budgeted for. Based on where you are in the audit calendar, you might want to
show if the audit department is working overtime, or is on schedule with the budgeted amount of hours to
date.
TIP 5: IT ALL COMES DOWN TO THE FINISH (AN OLD CARPENTERS RULE)
In the end, the audit report is the proof of your work, the most visible document of the audit engagement.
So how knowledgeable is this report?
Before you issue your report, look at the number of meetings that your auditors have had with auditees
(clients and stakeholders). Examine the content of the meetings. Ask yourself if the client has understood
the objectives of the audit, its scope, and of course, its findings. Make sure that those findings have been
validated by the client. Otherwise, you could end up with errors in data, causing you to lose all credibility
forever.
Originally published on Auditandrisk.org.uk in August 2012. Not to be reprinted without permission.
Ensure that your audit report has a list of the recommendations implemented. Ask yourself Will my
report hit my stakeholders between the eyes? Will they immediately realize the point to the report? A
good rule of thumb is to ensure that at the beginning of the report, youve addressed the following:

The importance of the audit (i.e. why does this audit matter?)

The creation of a sense of urgency (i.e. the desire to address the audit findings)
Failing to address these two critical points immediately in your audit report, may put the report and you at
the risk of disengaging your stakeholders.
While the audit report is the single most important evidence of your value to the organisation, it can be
extremely complex to prepare. Most companies use manual reporting processes that are cumbersome and
time-consuming. Try replacing them with an automated reporting tool that automatically incorporates
audit findings and analyses in predefined reporting templates. You could save a lot of time, effort, and
resources this way.
Simplify your audit reporting process by making it more streamlined, structured, and standardised
through the use of integrated analytics and reporting tools. These tools will help you gain quick and easy
access to audit data, summarise results and observations, and highlight critical information.
As audit requests become more ad hoc and frequent, it is important to facilitate real-time visibility into
audit data across the enterprise. Executive dashboards provide top-level visibility for CAEs to track the
status of audits, as well as the implementation of corrective actions and recommendations. They also
provide valuable risk insights and intelligence, advanced GRC analytics, what-if scenarios, and other
operational metrics which are crucial for making decisions and defining audit strategies.
ADDITIONAL WAYS TO ADD VALUE TO THE ORGANISATION

Be the second set of eyes for the Chief Accounting Officer. Put your CPAs in your team to
work, and have them act as advisors on how to treat complex accounting transactions.

Act as a project manager (assuming your organisation does not have a PMO in place), and help
keep the IT department working on time and within budget for major IT projects.

When performing audits, look for business process automation opportunities that can contain
costs and improve efficiencies. Research industry-specific vendors, and incorporate valuable
industry benchmarks and best practices into your audit recommendations.

Above all, remain relevant. Stay up-to-date on the changes and impact of technology, accounting
guidance, and regulatory guidance on your industry.
To be a successful internal auditor, you need to be the master of all areas of your business triangle:
people, processes, and technology. Dont view your department simply as a compliance shop. Put on
your advisory hat and start thinking creatively. The good news is that as an auditor, you know where the
problems are. So be a part of the solutions, and incorporate benchmarks and best practices into your
recommendations. The only constant in business today is change. Inflexible auditors that cannot adapt to
change will become obsolete, and your department will lose credibility and value.
CONCLUSION
By applying the tips mentioned throughout this article, you should be able to quantifiably measure the
value added by your internal audit department. Ultimately, you should run your department based on
measureable data. Follow your own instincts on how to effectively use data and transform it into
valuable information. Monitor your own KPIs. And as always, continue to add value to your clients
businesses.
Originally published on Auditandrisk.org.uk in August 2012. Not to be reprinted without permission.