As the saying goes, “You can’t manage what you don’t measure.” This well-known quote, often attributed to management expert Peter Drucker, holds true across most business functions, including internal audit. To optimize performance, internal audit departments need to track key metrics that reflect both their operational efficiency and their effectiveness in delivering value to the organization.
However, unlike manufacturing environments where productivity metrics like output per hour are easy to track, measuring the value of an internal audit team is more complex. As Glenn Sumners, director of the Center for Internal Auditing and Cybersecurity Risk Management at Louisiana State University, puts it, “You need some way to evaluate performance. Identifying metrics that assess the department’s value and measuring performance against them can drive greater effort.”
In recent years, many internal audit departments have expanded the range of metrics they track, moving beyond simple measures like audit completion rates. This broader perspective can help internal auditors articulate the value they provide, says Sarah Fedele, U.S. internal audit leader and principal at Deloitte Risk and Financial Advisory.
Let’s explore key internal audit metrics, divided into two categories—efficiency and effectiveness—along with real-world examples of how organizations use these metrics to improve their audit functions.
Internal Audit Metrics that Measure Efficiency
- Percent of Audit Plan Completed
A fundamental metric for many internal audit teams is the percentage of the audit plan completed. This helps track whether the internal audit function is sticking to its planned activities and effectively managing its resources. Dawn Williford, market managing partner for risk advisory services at BDO, emphasizes the importance of monitoring this metric continuously, as audit plans often evolve with shifting priorities.
At Leidos, a Fortune 500 defense and intelligence company, Chief Audit Executive Thomas Sanglier stresses the importance of accountability: “The goal is promises made, promises kept.” Sanglier’s team tracks the audit plan throughout the year and is transparent when audits need to be carried over or revised, ensuring that any deviations are justified and communicated clearly.
- Budgeted to Actual Hours
Another key efficiency metric is tracking the number of hours budgeted for each audit project versus the actual hours spent. This not only helps monitor individual project timelines but also provides insights into the audit team’s overall utilization and productivity. At Leidos, Sanglier’s team carefully monitors both metrics to understand how many audits they can reasonably complete each year. This approach ensures that resources are allocated effectively and workloads are balanced.
- Audit Cycle Times
Long, drawn-out audits can lead to “audit fatigue,” where both the audit team and the business unit being audited become disengaged. Measuring the time it takes to complete an audit, from planning to final report, can drive efficiency by keeping the process on track.
Leidos aims to issue audit reports within 15 business days after completing fieldwork, a goal that forces the team to stay focused. To streamline the process, the audit team discusses potential issues immediately with both the audit customer and upper management. By keeping all stakeholders informed throughout the process, they reduce surprises and expedite the final reporting.
- Auditor and Technology Utilization Rates
Tracking auditor utilization rates can help identify whether team members are being appropriately utilized. As Sophie Campbell-Smith, partner in enterprise risk at EY, points out, it doesn’t make sense to have multiple auditors “on the bench” without active assignments. This data can help balance workloads across the team and ensure that talent is being used effectively.
Additionally, many internal audit departments are leveraging data analytics to enhance their audits. At Leidos, the audit team actively tracks the use of data analytics tools, with the goal of integrating them into every audit. This not only improves the audit process but also provides deeper insights into the areas being audited.
Internal Audit Metrics that Measure Effectiveness
- Value of Recommendations Implemented
The true value of internal audit lies in the recommendations it makes and their subsequent implementation. Many internal audit departments track how often their recommendations are adopted and measure the tangible benefits that result.
For example, a recommendation to eliminate duplicate payments can generate immediate financial savings, while other recommendations might improve operational efficiency or streamline processes, freeing up employee time. Campbell-Smith stresses that tracking these outcomes can help internal auditors articulate their value to the organization.
- The Level of Automation in Recommendations
As companies continue to digitalize their operations, audit recommendations that promote automation can help streamline processes. Sanglier highlights this as a key focus for his team at Leidos: “If we make a recommendation, we strive to make sure that it includes automation.” By encouraging the adoption of automation, internal audit can help the company improve long-term efficiency.
- Observations Closed
Tracking the closure of audit observations is another fundamental metric. At Jackson Financial, Chief Audit Executive Stacey Schabel ensures her team follows up on any issues raised during audits, especially those that pose a risk to the organization. After management implements a solution, the audit team returns to test its effectiveness, ensuring that risks have been properly mitigated and that the solution is sustainable.
- Management Requests
One way to gauge the value internal audit brings to an organization is by tracking how often business units request their assistance. At Leidos, Sanglier monitors management requests for audit support, which can indicate that business units view internal audit as a valuable partner. This collaboration not only strengthens relationships but also helps auditors better understand the business units they are auditing.
- Peer Benchmarking and Risk Coverage
Comparing internal audit metrics to those of peer organizations can provide valuable context. Schabel’s team at Jackson Financial regularly benchmarks their audit performance against industry peers, checking how well they are covering top organizational risks relative to other firms.
In addition to benchmarking, it’s critical to assess how well internal audit is covering the organization’s strategic, financial, operational, and compliance risks. As cyber security becomes an increasingly significant risk, for instance, audit teams must ensure they are providing adequate coverage in this area.
Managing Internal Audit Metrics
Tracking internal audit metrics requires a significant investment of time and resources. As Mark Ruppert, Chief Audit Executive at Northern Arizona University, notes, smaller audit departments may face greater challenges in managing these metrics due to limited administrative resources.
It’s essential to focus on metrics that matter, especially at the board level. While tracking cost savings or revenue enhancements can be useful, an overemphasis on these metrics could create unrealistic expectations. As Ruppert explains, “An ongoing expectation of meeting or exceeding prior year results for such a measure would not be appropriate.”
By selecting the right metrics and using them effectively, internal audit departments can improve both their efficiency and their ability to demonstrate value. In an environment where many audit departments face budget and headcount constraints, metrics provide a powerful tool for articulating their contribution to the organization’s success.
Conclusion
Effective performance measurement is essential for internal audit departments to drive improvements and demonstrate their value. By tracking a combination of efficiency and effectiveness metrics—such as audit completion rates, cycle times, the value of recommendations, and peer benchmarking—internal auditors can help ensure they are delivering maximum value to their organizations. Metrics provide the insight needed to make informed decisions, improve processes, and enhance the overall impact of internal audit.
Take your internal audit function to the next level with Connected Risk Internal Audit. Our comprehensive platform empowers you to track key performance metrics, enhance audit efficiency, and deliver greater value to your organization. From automating audit processes to gaining deeper insights through data analytics, Connected Risk ensures you stay ahead in managing today’s evolving risks. Don’t just measure performance—elevate it. Contact us today to schedule a demo and see how Connected Risk can transform your internal audit capabilities!