Risk Management

Metric of the Month: Internal Audit Staff Size

Does internal audit adequately cover the scope of the audit plan and report findings in a timely way?
Mary C. DriscollJanuary 8, 2016
Metric of the Month: Internal Audit Staff Size

Is your internal audit function in good shape?

Try answering some basic questions about it. Does internal audit provide reliable assurance of the effectiveness of internal controls? Does the internal audit function adequately cover the scope of the audit plan and report findings in a timely manner? Are sound suggestions for business process improvements routinely generated? Are key business risks addressed? Does the head of internal audit use a reliable system for measuring how well the function fares in light of its annual operating goals?

In November 2015, I focused on the overall costs of the internal audit department.  This time around I want to dive into a key driver of relative cost performance: staff size.

Efficiency and Effectiveness

See the bar graph below, which offers a look at relative staff size.  It illustrates the gap between top and bottom performers when it comes to labor allocation. The data is drawn from APQC’s Open Standards Research Database. In this case, the data represents the experience of 252 companies, most of which have annual revenues greater than $100 million.

Driscoll internal auditThe chart shows that top performers, those that comprise the top 25% of the data set, require roughly one-sixth of the labor pool (measured in terms of full-time equivalents, or FTEs) required by the bottom performers, those in the bottom 25%.

Clearly, it’s better to get the job done with a relative few employees. Further, CFOs want to know how well their labor investments stack up to peers. They have have such questions as: Are too many people situated in internal audit? Can the annual operating budget for internal audit be trimmed?

Opinion_Bug7In the realm of internal audit, finance chiefs will want to probe beyond the labor allocation metric. On top of operational efficiency, CFOs might ask: Do we have the right number of people focused on emerging or opaque risks that could conceivably send the business strategy careening into a ditch? Does the internal audit staff have the proper mix of process-management skills and topical knowledge that our company will need to sustain itself in today’s uncertain business environment?

In September 2014, PwC published a paper entitled: Metrics by design: a practical approach to measuring internal audit performance.

That paper proposed that CFOs should consider measuring, among other things, the alignment of talent with key business risks. This would require a careful consideration of potential threats, some of which may be newcomers to the enterprise risk portfolio.

One scenario comes to mind: a company is planning to expand by building or acquiring distribution networks in developing nations. The plan may expose the business to the risk of encountering business practices deemed reprehensible by U.S. courts. The internal audit team will need to have (or have access to) auditors familiar with the culture, language, government oversight mechanisms, and operating norms that dominate each new operating locale.

The CFO would thus want to make sure that the internal audit department maintains a performance scorecard that tracks the store of relevant knowledge needed for the plan to be effective. Perhaps that means studying the adequacy of the current talent- development model and finding ways to fill holes in the talent development agenda.

Cycle Time

Another angle on the relative performance of the internal audit function involves cycle time, the time it takes to perform tasks that make up a distinct process. The CFO would most likely want to get a handle on how quickly the internal audit function can investigate a violation of internal controls and develop remedial steps.

APQC benchmarks show that top performer can generally get this done at six times the speed of bottom performers. But once again, the finance chief will want to look beyond basic cycle time and assess the quality of investigations, information, and analysis presented to management in vital circumstances.

PwC suggests that having a well-crafted and well-understood charter for the internal audit department can go a long way in that regard. Such a charter would clarify the scope of services provided to the business and internal audit’s role in helping to deliver true value to all stakeholders.

Conceivably, some companies may limit their expectations. For instance, they might not ask internal audit departments to go further than assuring that internal controls work as needed. Others, however, may ask for much more. They might look to their internal auditors to provide proactive strategic advice well beyond the efficient and effective execution of the audit plan.

PwC uses the term Trusted Advisor to describe the internal audit function. It implies that internal auditors will strive to deliver value that can help the company achieve desired strategic outcomes. Measuring the performance of the Trusted Advisor will of course require a scorecard quite different from that used to measure the team tasked only with assessing internal controls.

Overall, CFOs must keep a tight grip on internal audit function costs. Labor costs tend to consume the lion’s share of financial management process costs, and many CFOs have no choice but to ask their staffs to do more with fewer people. At the same time, CFOs would do well to review their performance scorecards and devise portfolios of metrics that reflect functional efficiency, effectiveness, and strategic value added.

Mary C. Driscoll is a senior research fellow in financial management at APQC, a nonprofit business benchmarking and research firm based in Houston.