Sir Andrew Likierman introduces some of the key indicators when assessing the performance of the HIA.
The professional life of heads of internal audit (HIAs) involves sophisticated assessment and evaluation. Yet the way of measuring the HIA’s performance is often surprisingly primitive. To be fair, this is not just for the HIA – there are problems in assessing the head of any function.
Good performance measurement is not just important to provide the basis for remuneration and useful signals for improvement. It also underpins colleagues’ confidence in the HIA. Most don’t have the information to distinguish a good functional head, including the HIA, from one that is merely adequate. For the HIA there is the additional dimension of the ‘special relationship’ with senior management and the board that has no parallel in any other function.
Set out below is a measurement framework for HIAs. As with any framework, it will need to be tailored to the circumstances of individual organisations. The focus is on the private sector, though a number of aspects will be relevant to the public sector.
What not to measure
Let’s get some poor measures out of the way. Straight activity – numbers of audits, time taken for each stage of the audit or staff turnover – will be important as raw material to build up an overall picture about the HIA. But activity measures are generally of the function, not the individual, and even to give context are relevant only with comparisons with objectives, with other HIAs or with best practice. They are potentially misleading in isolation.
‘Value added’ sounds good, but is a better slogan than a measure. Applying the measure to control improvements or building corporate governance, the question is how value is measured, since value isn’t absolute. And again comparisons are essential.
The other problem in measuring value added is that there isn’t a counterfactual to tell us what would happen if the HIA wasn’t there. If comments on the need to add value are a polite way of saying that the HIA isn’t really focusing on the needs of the business, the HIA must establish whether this really is the issue so that remedial action can be taken.
Personal popularity (or unpopularity) isn’t a measure either. I knew one HIA who was convinced that being unpopular was a sign of rigour in the way he worked. He didn’t acknowledge that it also disastrously inhibited his ability to do the job. His replacement was someone who commanded respect and did a far more effective job just as rigorously.
Finally, of course, there’s no reason to link HIA performance and the performance of the organisation. The tendency is to believe that everyone’s doing well when the organisation is in good shape, and to treat everything and everyone as suspect in an organisation doing badly. But unless the HIA or internal audit is specifically implicated in a disaster, performance cannot realistically be linked in this way.
The performance matrix
The performance matrix in the chart (below) shows a suggested framework. It identifies the three main roles of the HIA:
- a professional role as expert
- a line management role as head of function
- an organisation-wide role as a member of the senior management team.
It’s in the interests of the HIA for each to be recognised in the measurement process.
Against each role, three comparisons should be made. These are performance against plan or objective, performance against others and performance against opportunity (what might have been).
Most organisations focus on performance against plan alone, which is not enough. Plans are difficult to set, and it isn’t unknown for HIAs to set levels over-conservatively. Hence the need to look at all three comparisons. Note that the matrix does not include performance against last year. This is because unless change is against an objective, the past is of limited relevance in measuring performance.
The performance matrix also gives examples of the kinds of measures which might be used (measure here doesn’t necessarily mean a number):
- performance against objective might cover a plan to disseminate good risk management practice
- performance against others might be how well the HIA compares with others as leader of a team of professionals
- performance against opportunity might be based on a look back at how an issue which came up during the year was dealt with compared with how it might have been tackled.
An indication of the relative difficulty of finding measures is given for each comparison. This is only illustrative. It will vary between organisations and may well vary over time. The toughest aspect is what’s possible as a technical expert – a measurement problem common to other professional heads.
Taking each comparison in turn:
- Comparison with plan/objective
This will be based on the budget but will need to go further than most budgets, which tend to focus on activity and process. Achievement of the audit plan is certainly important, but measures should also cover outcome and be linked to the risk agenda.
- Compared with others
The comparisons will be both internal and external. Even internal feedback needs to go further than straightforward figures – staff commitment based on the annual staff questionnaire might well give an indication of comparison with other functional heads, but commitment levels need to be interpreted in the light of staffing policy.
Finding external comparisons will rarely be easy. So it may be necessary to split the function into parts that can be compared, rather than looking at the function as a whole. For example, an assessment of quality of communication with the rest of the organisation or team leader qualities can be compared with leaders of other teams.
- Compared with what’s possible
Although only one of the boxes in the performance matrix is coloured red, it needs to be acknowledged that all measurement against opportunity is difficult. Independence of mind compared with the best possible standards is crucial, but may be difficult to pin down. This is where outsiders can play an important role (see below).
For most of the comparisons with what’s possible, we will never know what might have happened without the intervention of the HIA. Circumstances are so varied when this is assessed that it’s not easy even for the HIA to answer the question ‘How well might I have done if I’d known more?’
Nevertheless, the best HIAs will be asking themselves questions of this kind as a means of improving their performance, and they should certainly form part of any personal annual appraisal. 360 degree feedback should also help here, particularly on the views of internal audit team members.
In each case, commentary is essential and the results will be indications rather than conclusions. Numbers need also to be put in context, acknowledging the limitations of the data and of the measures used.
The role of outsiders
HIAs sometimes forget just how little many colleagues understand about their role, not least the dividing line between what is required and what is discretionary. Indeed the first time that colleagues may be aware of the quality of the HIA is when a successor arrives. This is just one reason why outsiders are so important to measurement.
Another is to help in making independent judgements. Even performance against objectives is rarely straightforward, since audit programmes and priorities change to varying degrees during the year. There’s also the need for judgement to take account of lags between actions taken and the results being evident.
So measurement needs to be more than asking a few colleagues ‘How happy are you with internal audit?’ The external experience of non-executive directors (especially those on the audit committee) as well as the auditors can add valuable insights. If possible, benchmarking using outside sources should be used. The top class HIA will always want to be aware of best practice.
Implications and conclusion
Using a performance matrix, adapted as necessary to the organisation, will provide better measures than an ad hoc measurement framework which does not acknowledge the multiplicity of HIA roles and the need for appropriate comparisons. The HIA can help the process by ensuring that colleagues fully understand the role.
Sending material about internal audit may be useful but is no substitute for face-to-face discussion – budget time provides a good excuse. Discussions are also much more likely to get feedback that is deeper and subtler than a questionnaire. Busy colleagues will fill in questionnaires as a duty, but not generally have time (or know enough) to complete descriptive boxes.
Existing methods may be limited, possibly ambiguous and probably uninformed. They may also be comfortable. Taking the initiative to go for something better structured is a risk. But HIAs are well able to judge risk. They will know that they have more to gain from a better-informed assessment than by taking their chances by continuing with a poor one.
This is an adapted version of an article first published in Internal Auditing and Business Risk in January 2006.
Andrew Likierman is Dean of the London Business School