I am writing my audit service’s performance measurement framework at the moment. I would normally regard this as a chore but it fits in with my current mode of thinking about what good internal audit is.
First of all there are all of the performance measures, KPIs, PIs etc. They all seem to measure inputs and processes and very little about outputs. Where they do typically measure outputs they seem to measure things that internal audit cannot control; the first no no in any performance measurement framework.
So why is it so difficult to measure internal audit? I think it is because meaningfully measuring anything complex is difficult. Most organisational things are subject to social and human factors. These are, by their nature, difficult to predict and measure. We just ‘feel’ what is right. But as regulators and particularly those of a US style, want metrics and want to see the world in scientific measurable way, what room is there for a socially scientific or artistic response of ‘it feels right’?
But as someone argued to me a little while ago when talking about report ratings – red is red and people know it’s bad. Well yes they do, but surely the world is a little more complex than differentiating on either a scientific binary yes / no scale or an artistic yes / no feeling.
So I come back to a formalised framework overlaid with a social scientific view of understanding people’s complexity. So coming back to my topic of what is good internal audit? Well I think, to some extent, you will know what it is when you see it. But in terms of more detailed measures, there have to customer measures, even though the customer relationship is not simple. There have to be input measures (but including more qualitative measures of staff’s quality), there have to be process measures (but not of bits that internal audit don’t control) and output measures (also don’t forget qualitative measures of quality here too).
I think the overall measures of greatest import are allocative efficiency measures, i.e. those measures that ensure internal audit does the right things and makes a strategic contribution to its clients. So many functions have assumed their right to exist within an organisation, HR, IT, Marketing, Finance. Yet internal audit is the one profession that still agonises over its right to exist. So what is a strategic contribution from internal audit?
I believe it is in getting the right answer. What is the right answer? Well again I think it is what feels right. Does the answer stack up? I have always had a sense of it and feel uncomfortable when I am not fully convinced about an argument. Whenever I have taken a risk and gone against this, the report or audit output has always been difficult and challenging to finalise and issue. Can this be measured? I guess not. Can it be felt and understood? Yes I think so. Audit committees have a sense of when something is not persuasive, even if the report says otherwise. So how will one measure this? Well I guess measure good internal audit by the ability of it to predict risk events. Does it have an ability to ‘pick’ the issues and be there to support management when needed?
I will need to think some more over what practical measures this entails, but it not the number of audit days, number of reports, or cost of people. It is more than that, it is what really matters, picking the big issues, telling them how they are, and being robust ethically and morally when the going gets tough. It is a sense of common sense (that is not common). I wonder then – how do you measure common sense?