President Kennedy famously said: “We choose to go to the moon in this decade and do the other things not because they are easy but because they are hard.” And yet how often do we fall into the trap of measuring success by what is easy, familiar, and within our control?
By focusing on completing audits, we can lose sight of our true purpose. If we really want to make a difference as agents of change and fulfil our mission to enhance and protect organisational value, then it’s time to look at ourselves — and encourage our stakeholders to do the same — through a completely different set of metrics from traditional measures.
“We have to demonstrate our willingness to innovate by paying attention to the things that ultimately matter.”
In this article, I outline the need for change and suggest seven ways to help us focus on delivering value instead of simply delivering the plan.
Change Is Needed and Opportunity Knocks
The profession can be slow to evolve. We have talked about agile auditing for at least ten years but have yet to fully embrace it. We have unprecedented access to big data and amazing new tools and techniques, yet few teams harness the potential of analytics, artificial intelligence, and natural language processing.
When traditional techniques are deeply ingrained, we are less than flexible and responsive, and miss opportunities to add value. We follow routine, implement our plans, and deliver our 40-page reports — which often have more to do with justifying auditors’ time than making an impact on the area under review. Just think of the long drafting and editing processes to get that report out. Is it time well spent?
There must be a smarter way. It’s time to take one giant leap forward by building on internal auditors’ passion for the profession and for provoking improvement. We need to be truly working with our organisations and not simply for them — and this requires a shift in how we understand and measure success.
Moving from Inputs and Outputs to Outcomes
Like everything else, internal audit is a scarce resource that must be optimized. How do we gauge success? It can be comforting to report input and output metrics — like budget variance, planned versus actual audit days, number of reports delivered on time, and percentage of plan completed — but we must go beyond merely measuring audit service delivery. Did the client find value in our work? Did we help the organisation strengthen controls and achieve its priorities? Did our assurance or advice come when it was most useful? Were improvements agreed and implemented, not simply recommended? Have we been invited back to provide further assistance?
When we communicate our KPIs we are telling stakeholders what is important to us, and that should mirror what is important to senior management and the board. Aligning our goals with outcomes changes both actual and perceived audit prioritization, and requires us to use relevant qualitative and quantitative metrics reflective of our mission.
Below are seven suggestions to shift emphasis from delivering the plan to delivering value.
1. Strategic alignment
For the work of internal audit to be relevant and add the most value it must be aligned with the audit committee’s and management’s view of strategic risk.
Potential measures: Using an assurance map to demonstrate internal audit coverage is a simple yet effective way to present this. This allows discussions to take place where there are assurance gaps.
2. Rolling plan, live audits
Audits need to take place when they are needed rather than when it is convenient to schedule them. A rolling plan reflecting changing risks and priorities stays aligned with what is important.
Potential measures: A simple KPI could be the number of meetings held with the C-suite to discuss the rolling plan coupled with stakeholder feedback on the effectiveness of the IA coverage, are we auditing the right things?
3. Timely insights
Instead of waiting for the delivery of a report, auditors can provide insights before, during, and after an engagement through meaningful dialogue with management.
Potential measures: Quality and timing of insights, improved collaboration, improved customer feedback, reduced time from issue identification to remediation.
4. Value added
Internal audit can add more value by prioritizing higher value activity and helping management by:
- Providing wider assurance through use of data analytics.
- Helping save money (for example, identifying way to eliminate duplicate payments and unnecessary controls)
- Provide guidance for improving poor or ineffective controls.
- Providing advice from the earliest stages of strategic initiatives (e.g. system implementation).
- Providing advice on timely and cost-effective improvements.
Potential measures: cost savings; performance improvements.
5. Management actions
Audit reports may contain lists of opportunities or recommendations, but there is no actual improvement unless actions are implemented. Discussions with management during the drafting process can help streamline the report by including agreed rather than potential actions.
Potential measures: the number of actions agreed and implemented; aged actions analysis (akin to aged debtors’ analysis).
6. Customer response.
The key question is: did we add value? It is vital to solicit and utilize feedback.
Potential measures: Profiles and trends; qualitative feedback; number of audits requested by function.
7. Audit efficiency
As a function internal audit has a responsibility to operate efficiently, doing more with less, while recognizing it is not a factory production line but a responsive and symbiotic service.
Potential measures: By looking at the financial budget and seeing the breakdown of how the service is delivered:
- Team numbers, year on year
- Alternative Technology Solution expenditure
- Qualitative feedback
- Time from audit planning to report issuance
Measuring the Things that Matter
As agents of change, we must set our sights on our contribution to both preserving and creating value. And we have to demonstrate our willingness to innovate by paying attention to the things that ultimately matter.
To end with Kennedy again, we should do these more difficult things because a focus on true impact “will serve to organize and measure the best of our energies and skills.”
Let’s take this giant leap together.
David Hill is the CEO of SWAP Internal Audit Services based in the UK. David has nearly 40 years of audit experience, is currently Chair of the Local Authority Chief Audit Network, and is a former member of the Global Guidance Committee. Connect with David on LinkedIn.
