Utilizing Internal Audit Metrics to Advance Your Department May 17, 2018

A little about me…. 22 years of experience in public accounting performing a wide variety of audit, compliance, and consulting services Since 2009 have led or been a subject matter expert on more than 30 External Quality Assessments (EQAs) mainly focusing on Fortune 500 companies Developed PwC’s updated methodology, tools, and training for performing strategic assessments (Generation 2, firm is now on Generation 3) Developed the firm’s practice aids for developing metrics and KPIs for Internal Audit functions

The Struggle with Metrics and KPIs Most audit departments struggle with metrics and KPIs Only look at them when its time to do your quarterly Audit Committee reporting Always worried that what they are reporting is not enough or telling a relevant story Little or no discussion with Audit Committee and Stakeholders about metrics for performance Lack the planning to identify, track and develop metrics that are meaningful Extreme focus on completing audits, leaving departmental improvement actions for “available” time Disagree on what is impactful for the department and its employees

Why Such a Struggle? Few Audit Committees focus on metrics. Use them to make sure things are progressing, but spend little or no time discussing what story the metrics truly convey . Stakeholders are more focused on impact of the audit function, not on how efficient or well run the department operates (they assume it already is) CAEs and other Internal Audit leaders focus on value provided by Internal Audit, although this value typically is not quantifiable.

Lost opportunities 1) No strategic plan and/or program management - Metrics/KPIs can and should be used to improve the audit function through the use of a strategic plan or similar activity. 2) Under-utilization of their Quality Assurance and Improvement Program (QAIP) - Too much focus on audit work papers - Not enough focus on improvement activities that can be measured 3) Leadership coaching and development - Many of the business functions we audit have action plans and related metrics to demonstrate progression and success. So should Internal Audit!

Next steps Step 1: Develop a Balanced Scorecard There are no requirements or required areas, it is based on your company’s and department’s expectations, goals, and improvement opportunities. Example categories may include the following: - Stakeholder Management - Financial - Process - People Big learning point: The scorecard should be prepared for both Stakeholders and Departmental use only. Departmental metrics can and should change each year. For example, take these two metrics: Completion of audit plan year to date Average utilization of staff on direct audit activities Which one would you report to the Audit Committee? Which one would you track internally?

Next Steps continued Step 2: Ask the Audit Committee what they want to see. - In most cases, they ask you what should be reported. - Most common metrics used by audit functions: What’s wrong with this list? Percentage of audit plan completion Budget management Issue management resolution Department turnover Employee Certifications Training completed

Next Steps continued Step 3: Develop a strategic plan AND related project management support to carry it through The second part is where we see time and time again various levels of failure for many functions. But why???  not a core part of our skill set as auditors. It is always last on our to-do list  Audit Committees and Stakeholders are not typically looking for updates on your achievement of your strategic plan. It gets lost in the shuffle.  Performance evaluations are rarely tied to the achievement of strategic plan goals  Little or no linkage to the QAIP activities

Areas to consider – Stakeholder metrics These can be tailored to your specific goals. Be flexible in what you are trying to measure and how that relates to your goals Category Metric Scorecard Goal Alignment Stakeholder satisfaction ratings Stakeholder Improvement Achievement of relationship improvement goals Strategic Meetings with executive team Information & insights Timeliness of reports High risk/relevance of issues identified Issue tracking & follow up Operational Trends and insights provided

Areas to consider – Financial metrics Some of these metrics may be used with the Audit committee depending on the desired communication goals for your function. Some of these may be applied in several methods depending on your needs. Category Metric Scorecard Goal Cost Cost to revenue ratio Financial Strategic Cost to external audit fee ratio Ave loaded cost per audit Improvement Cost per FTE Operational Budget to actual Organizational impact $ recoveries identified Cost savings identified Asset efficiencies identified

Areas to consider – Process metrics These are usually internally driven metrics that demonstrate efficiency and effectiveness of department operations Category Metric Scorecard Goal Cycle time Ave days from plan to final report Process Operational Ave days from close to final report Productivity Percentage of audit plan completed Ave utilization on direct audit activities Improvement Estimated versus actual man-days per audit Technology leverage Percent of audits using specific tools ROI of technology investments Strategic Continuous auditing & monitoring penetration

Areas to consider – People metrics These metrics can be a mix of Audit Committee and departmental use metrics to drive improvement. Category Metric Scorecard Goal Staffing model Staff to management leverage ratio People Strategic Talent Ave number of vacant positions Operational Number of unplanned separations Improvement Number of placements into the business Annual performance rating trends Percentage of professional credentials Training hours Staff satisfaction Strategic skill gap progress

Pulling it together Once you know what you are measuring, Use your QAIP activities as the process to manage these metrics Communicate these consistently based on your rhythm of reporting Add/remove department only metrics as needed based on your goals and plan Make sure everyone in the department knows what is being measured Be willing to change your plans if your goals or demands of your business change Reevaluate metrics at least yearly to make sure they are relevant

Thank you! Questions?