Loading presentation...

Present Remotely

Send the link below via email or IM

Copy

Present to your audience

Start remote presentation

  • Invited audience members will follow you as you navigate and present
  • People invited to a presentation do not need a Prezi account
  • This link expires 10 minutes after you close the presentation
  • A maximum of 30 users can follow your presentation
  • Learn more about this feature in our knowledge base article

Do you really want to delete this prezi?

Neither you, nor the coeditors you shared it with will be able to recover it again.

DeleteCancel

Make your likes visible on Facebook?

Connect your Facebook account to Prezi and let your likes appear on your timeline.
You can change this under Settings & Account at any time.

No, thanks

"Which KPIs are appropriate for Internal Audit?", 22MAY, 2014, Amsterdam_Nuno Castanheira

No description
by

Nuno Castanheira

on 4 September 2014

Comments (0)

Please log in to add your comment.

Report abuse

Transcript of "Which KPIs are appropriate for Internal Audit?", 22MAY, 2014, Amsterdam_Nuno Castanheira

22 MAY, 2014, Amsterdam

8th Annual Internal Audit Forum for Financial Institutions
Which KPIs are appropriate
for Internal Audit?


1. Definition of KPIs

2. Why KPIs for IA?

3. Auditing goal-setting processes: interaction with Stakeholders

4. Examples of KPIs for IA

5. Things to consider related to commonly reported KPIs

6. Measuring IA effectiveness and efficiency

changing the paradigm
quantifying quality
identifying critical performance categories (PG)
identifying performance category strategies and measurements (PG)
balanced scorecard approach (PG)

CONCLUSIONS
AGENDA

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood. They often require less effort to collect and are readily comparable to the same metrics in other organizations.

According to the IIA,
Key Performance Indicators
(KPIs) are important measures of a business’s performance and progress toward goals (dictionary.com). They are metrics related to critical success factors. Some are
quantitative
and easily measured, while others are
qualitative
.

Definition of KPIs

h
Why
Key Performance Indicators
for Internal Audit?
International Standards of Internal Audit
Regulation
Best Practices
- The CAE must develop and maintain a quality assurance and improvement program (1300), that must include both internal and external assessments (1310). Internal assessments must include
ongoing monitoring of the performance
of the internal audit activity (1311). The internal audit activity
should identify appropriate KPIs
(guidance).
The UK Corporate Governance Code (2012)

C.3.2. The main role and responsibilities of the audit committee should be set out in written terms of reference and should include:

-
to monitor and review the effectiveness of the company’s internal audit function
;

Recommendations from the Committee on Internal Audit Guidance for Financial Services (Chartered IIA, 2013)

24. The Board or the Audit Committee is responsible for
evaluating the performance of the Internal Audit
function on a regular basis. In doing so it will need to identify
appropriate criteria
for defining the success of Internal Audit.
Delivery of the audit plan should not
be the sole criterion in this evaluation.

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

The internal audit activity should identify all relevant
stakeholders
(e.g. audit committee, senior management, etc.) and meet with them to discuss their vision and expectations for the function.
Auditing goal-setting processes: interaction with stakeholders

h
The internal audit activity should develop internal audit’s strategic vision, role and objectives in compliance with IIA Standards and applicable laws and regulations and should ensure
stakeholder
satisfaction.
According with the IIA (practice guide), establishment of KPIs should be done in a group that includes senior management, as well as the board, and there should be consensus that the KPIs chosen are meaningful and appropriate.
Once the KPIs are understood and agreed, a monitoring process and a method of reporting to
stakeholders
should be established (e.g., format, timing, and metrics). It is important for the internal audit activity to obtain feedback from key
stakeholders
on audit effectiveness and make adjustments where needed.
Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

There are numerous KPIs internal auditors can use to measure the effectiveness of IA. A July 2012 publication reported some used metrics to measure IA effectiveness, based on a survey to board members, top executives and CAEs.

Examples of KPIs for Internal Audit (based on a survey)

h
Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Recently, an April 2014 publication reported the KPIs used in six organizations to measure IA effectiveness, based on interviews of CAE. According to the authors, the interviews reveal that internal audit metrics can be divided roughly into two categories: those that pertain to the operations of IA and those that pertain to the reactions of the organization to the IA. The tables below summarize the KPIs related to the operations of IA and the organization´s reactions (how other in the organization view IA).
Examples of KPIs for Internal Audit (based on interviews)

h
Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h
95%
97,5%
95%
90%
within budget
5% below budget


For a moment, let’s examine some traditional measures for a hypothetical organization. Is this an effective internal audit department?

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h

Is the department auditing the right things
?


Is the department auditing high-risk areas
?


Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h
It is important to get the audit report to the audit client on time, but this metric should be used cautiously. Internal auditors should not push out a poor report to meet a deadline.

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h
Staying within budget is good. But, internal audit should be prepared to go to the audit committee for additional funds if new or changed risks emerge.
Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Measuring IA effectiveness and efficiency
(changing paradigm)
h
Traditionally internal auditors use
quantitative
KPIs.

Internal auditors are realizing that a good method of evaluating internal audit's effectiveness should use relevant measures that incorporate both
qualitative and quantitative indicators
.

Nowadays, there is an increasing emphasis in getting
feedback from audit customers and other stakeholders
.


Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h
Measuring the performance of the internal audit function is important, so the department needs to develop performance metrics
carefully
and use them with
good judgment.

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h

Is the department auditing the right things
? For example, IA should not prematurely close out an audit and fail to ask important questions just to stay on schedule.


Is the department auditing high-risk areas
? IA should not continued to remain glued to their plan even when risks changed, failing to audit what matters now.


Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h
It is important to get the audit report to the audit client timely, but this metric should be used cautiously. Internal auditors should not
pushes out a poor report to meet a deadline
. CAE don´t want audit staff to start closing out audits, no matter what, because they are being evaluated on how quickly they finish the fieldwork and issue the report.
Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Things to consider related to commonly reported KPIs
h
Staying within budget is good. But, internal audit should be prepared to go to the audit committee for additional funds if new or changed risks emerge. IA should not fail to ask for additional funds just to stay on budget.
Nuno Castanheira, MSc, CRMA

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Measuring IA effectiveness and efficiency
(quantifying quality)
h
Internal auditors must understand what constitutes successful and effective performance from the stakeholders point of view, and then come to an agreement with them regarding how it will be measured.

A common way of measuring the quality of internal audits is to quantify the level of customers and stakeholders satisfaction.

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Measuring IA effectiveness and efficiency
(PG: identifying critical performance categories)
h
In December 2010 the IIA released a Practice Guide about Measuring Internal Effectiveness and Efficiency. The Practice Guide recommends a balanced scorecard approach be used to track performance measurement into three broad categories:

Stakeholders could include the Audit Committee, Executive Management, external government bodies and regulators, and the external auditors.
Audit processes could include risk assessment, planning and audit methodologies.
Innovation and capabilities could include effective use of technology, training and industry knowledge.
Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Measuring IA effectiveness and efficiency
(PG: identifying performance category strategies and measurements)
h
In the example below is illustrated how the Chief Audit Executive might determine the appropriate strategy and measurements for innovation and capability, linked to the internal audit strategy.

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

Measuring IA effectiveness and efficiency
(PG: balanced scorecard approach)
h
Following is an example of a balanced scorecard type approach that an internal audit activity could use, that lists some of the most reported measures, including in financial institutions.
Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

h
8th Annual Internal Audit Forum for Financial Institutions
Which KPIs are appropriate
for Internal Audit?

Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

CONCLUSIONS
h

There isn´t a “one size fits all”
set of key performance indicators;

Companies should develop their
own specific measures
that best meet internal audit activity’s and organization’s needs;

The
appropriate
KPIs will
vary
from entity to entity depending on their
internal audit strategy
and the role assigned to internal audit;

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

CONCLUSIONS
The establishment of KPIs should be
linked to stakeholders expectations
, and there should be consensus that the KPIs chosen are
appropriate
;

The CAE should ensure that the KPIs used are
appropriate
for their activity’s size and their applicable industry, country, national laws and regulations;

While
no single KPIs is best
, research suggests the use of both quantitative and qualitative KPIs, including seeking feedback from stakeholders.


Qualitative KPIs
are often based on the collection of unique information through more time intensive methods such as survey research or interviews. They offer a broad view of performance on a range of topics that can provide depth to quantitative metrics.

Quantitative KPIs
are often based on existing or obtainable data and are easily understood (e.g., completed vs. planned audits). They often require less effort to collect and are readily comparable to the same metrics in other organizations.

h
Full transcript