Professional Documents
Culture Documents
IPPF Practice Guide. MeasurINg INterNal Audit Effectiveness and Efficiency
IPPF Practice Guide. MeasurINg INterNal Audit Effectiveness and Efficiency
MeasurINg
INterNal audIt
eFFeCtIVeNess
aNd eFFICIeNCY
deCeMber 2010
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
Table of Contents
Executive Summary ........................................................................................1
Introduction ...................................................................................................1
www.theiia.org/guidance / B
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
www.theiia.org/guidance / 1
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
1300 – Quality Assurance and Improvement Additional guidance on applying the Standards is found
Program in:
The chief audit executive must develop and maintain a • Practice Advisory 1300-1: Quality Assurance and
quality assurance and improvement program that covers Improvement Program.
all aspects of the internal audit activity. • Practice Advisory 1310-1: Requirements of the
Quality Assurance and Improvement Program.
Interpretation:
A quality assurance and improvement program is designed • Practice Advisory 1311-1: Internal Assessments.
to enable an evaluation of the internal audit activity’s con- • Practice Advisory 1312-1: External Assessments.
formance with the Definition of Internal Auditing and the
Standards and an evaluation of whether internal auditors This practice guide suggests using the analysis of per-
apply the Code of Ethics. The program also assesses the ef- formance measures as an element in conducting these
ficiency and effectiveness of the internal audit activity and internal/external reviews. It provides examples to be con-
identifies opportunities for improvement. sidered when measuring an internal audit department’s
effectiveness and efficiency for various internal and ex-
1310 – Requirements of the Quality Assurance ternal customers. The examples should not be considered
and Improvement Program the only factors to use. Also see Appendix A for additional
reference material on this topic.
The quality assurance and improvement program must
include both internal and external assessments.
defining Internal audit
1311 – Internal Assessments
Internal assessments must include:
effectiveness and efficiency
• Ongoing monitoring of the performance of the inter- A general description of effectiveness and efficiency is “the
nal audit activity; and degree (including quality) to which established objec-
tives are achieved.” The same description can be used
• Periodic reviews performed through self-assessment for internal audit effectiveness and efficiency. Internal au-
or by other persons within the organization with suf- diting should establish performance metrics and related
ficient knowledge of internal audit practices. measurement criterion appropriate to its environment/
organization to measure the degree (including quality)
1312 – External Assessments of achievement of objectives for which the internal audit
External assessments must be conducted at least once activity is established. (See Appendix B for examples of
every five years by a qualified, independent reviewer or re- questions that could help determine internal audit qual-
view team from outside the organization. The chief audit ity.) Internal audit effectiveness and efficiency should be
executive must discuss with the board: monitored and assessed periodically as part of the inter-
• The need for more frequent external assessments; nal audit process.
and
• The qualifications and independence of the external
reviewer or review team, including any potential
conflict of interest.
www.theiia.org/guidance / 2
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
www.theiia.org/guidance / 3
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
www.theiia.org/guidance / 4
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
• Develop measurement tools such as a balanced scorecard to document relevant attributes of effectiveness and
efficiency and related performance against these.
• Agree upon effectiveness and efficiency metrics with key stakeholders.
▼
Monitoring and Reporting Results
• Establish an agreed upon format and frequency for reporting that considers the organization’s size, nature, and
governance structure.
• Establish a periodic review of such monitoring and reporting to ensure relevance, efficiency, and effectiveness.
• Use the results of reporting to shape and guide internal audit activities.
• Align internal audit activities to the defined measures of internal audit effectiveness and efficiency.
When developing performance measures, the internal audit activity should consider:
• How effective are the performance measures linked to the internal audit activity’s strategy?
• Do performance measures include both leading and lagging indicators?
• Do performance measures reflect the mandate and role of the activity?
• How effectively are performance measures used for continuous improvement?
Performance metrics can be established along dimensions, interests, and perspectives of a variety of key stakeholders.
Each perspective would include related measures.
Audit Committee
IIA Standards
Management/ Departmental Outcomes and Priorities Internal Audit
Auditees Legislation/Policy Processes
Innovation and
Capabilities
Source: Adapted from A Balanced Scorecard Framework for Internal Auditing Departments, by Mark Frigo, copyright
The IIA Research Foundation, Altamonte Springs, FL, 2002 used with permission.
www.theiia.org/guidance / 5
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
Audit Committee:
• Satisfaction survey
• Risk concerns
Management/ • Plan input Internal Audit
Auditees: Processes:
• Satisfaction survey • Risk coverage
• Average number of • Percent completed vs.
recommendations IIA Standards planned audits
per audit Departmental Outcomes and Priorities • Number of
• Percent of
recommendations
Legislation/Policy recommendations/audits
• Actual vs. planned costs
implemented by • Elapsed audit time start
corrective action date to finish
• Cost savings • Conformance to policy
• Changes to processes Innovation and Capabilities: and Standards
• Staff experience • Quality assurance
• Training hours/auditor techniques developed
• Percentage of staff holding relevant designations
• Number of innovative improvements implemented
• Number of process improvements
• Percentage of surprise risk events
www.theiia.org/guidance / 6
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
Monitoring and reporting Consistent processes are needed for gathering, summa-
rizing, and analyzing measurement data. Responsibility
results for performing and validating measurement data should
be established similar to any other audit engagement.
Internal auditing’s effectiveness and efficiency should be
reported to its stakeholders periodically. The CAE should The CAE may consider periodic benchmarking of its cur-
obtain feedback from key stakeholders on internal audit- rent metrics and criteria with those being used by peer
ing’s effectiveness and efficiency in reporting (e.g., for- organizations. This can help ensure current and appropri-
mat, timing, metrics) and make efforts to align reporting ate criteria are in place for measuring internal auditing’s
to their needs. effectiveness and efficiency.
www.theiia.org/guidance / 7
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
appendix a:
reference Material
Quality Assessment Manual, by The IIA (IIA Research
Foundation, 2009).
www.theiia.org/guidance / 8
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
Questions that Should be Answered to 13. Have team members acquired professional
Adequately Gauge and Provide to Varied designations that demonstrate their competency?
Stakeholders Reasonable Assurance of
Internal Audit Quality 14. Has the internal audit activity obtained an
independent external quality assessment within
Source: www.theiia.org/guidance/quality. Under Advocacy, the past five years?
click on The Audit Committee: Internal Audit Oversight
www.theiia.org/guidance / 9
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
appendix C:
Examples of Internal Audit Effectiveness and Efficiency Metrics
basic Measures • Number of audits scheduled. • Client satisfaction ratings. • Training/CPE hours.
• Number of audit completed. • Staff satisfaction ratings. • Staff turnover/retention.
• Timeliness of performance • Number of signifi cant audit
feedback. findings.
• Staff utilization – direct vs. • Percent of recommendations
indirect time. implemented.
• Completed audits per auditor. • Number of repeat fi ndings.
• Actual hours vs. budgeted • Number of open audit fi ndings
hours. past planned corrective action
• Audit report cycle time: date.
elapsed time from open- • Number of unsatisfactory
ing conference to fieldwork internal audit opinions.
completion and elapse time
from fi eldwork completion to
fi nal report.
• Number of internal audit
reports issued vs. planned
internal audits.
service to stakeholders • Responsiveness to special • Delivery of high quality • Client survey scores (see
requests. service. example survey letter in
• Average response time to • Management of auditee Appendix E).
management request. expectations. • Senior management survey
• Number of control self- • Building strong relationships. scores.
assessment (CSA) sessions • Number of management • Audit committee survey
conducted. requests. scores.
• Number of auditors per 1,000 • Number of committees and • Number of positive and
employees. task forces audit is involved negative feedback about
• Number of auditors per $1 in. audits/auditors.
million of revenue/$1 million • Amount of identified cost
of assets. savings and percent of
• Completed vs. planned audits. recoveries.
• Cost savings as a percentage
of department budget.
www.theiia.org/guidance / 10
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
www.theiia.org/guidance / 11
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
People development • Number of coaching sessions • Average months in position. • Assistance in recruiting by
in a year. • Number of staff rotations in team members (participation
• Tracking of development plan and out of the internal audit in review of resume, interview
(plan vs. actual). activity. etc.).
www.theiia.org/guidance / 12
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
appendix d:
Example of Reporting Internal Audit Effectiveness and Efficiency Dashboard
quaNtItatIVe Measures
area Measure target actual
q1 q2 q3 q4
Budget management. Budget vs. actual.
Delivering the annual audit plan. Percent of audit plan delivered during the year.
CustoMer serVICes
area Measure target actual
q1 q2 q3 q4
www.theiia.org/guidance / 13
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
appendix e:
Example of Customer Survey Sent After Internal Audit is Completed
Dear XXXXX:
We recently performed an internal audit in your area. To continue to improve the level of service we provide
our customers, we would appreciate your candid feedback on the attached Internal Audit Feedback Survey.
We value the opinions of our clients and stakeholders and will use your feedback to continually evaluate the
quality of our audit services. Please send the completed survey back to me by (date).
If you have any questions, please do not hesitate to call me at (phone number).
Sincerely,
CAE or Auditor
The rating scale provided below is from 5 (strongly agree) to 1 (strongly disagree).
5 4 3 2 1 Not done
strongly agree Neither disagree strongly
audIt qualItY agree agree nor disagree
disagree
1 Opening conference was held and all questions/comments were
adequately addressed.
2 The fi nal audit objectives and scope were agreed to.
www.theiia.org/guidance / 14
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
Thank you for completing the above survey! Please return by (Date).
www.theiia.org/guidance / 15
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
authors
Gregory S. Dubis, CIA, CCSA
Amipal Manchanda
www.theiia.org/guidance / 16
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for anyone
About Practice Guides placing sole reliance on this guidance.
Practice Guides embody an IIA statement to assist
a wide range of interested parties, including those Copyright
not in the internal audit profession, in understand- The copyright of this position paper is held by The
ing significant governance, risk, or control issues IIA. For permission to reproduce, please contact
and in delineating the related roles and responsi- The IIA at guidance@theiia.org.
bilities of internal auditors on a significant issue.
Practice Guides are part of The IIA’s International
Professional Practices Framework. As part of the
Strongly Recommended category of guidance,
compliance is not mandatory, but it is strongly
recommended and the guidance is endorsed by
The IIA through formal review and approval pro-
cess. For other authoritative guidance materials
provided by The IIA please visit our Web site,
www.theiia.org/guidance.