For many years, the performance of internal audit functions has been measured using a familiar set of operational metrics: audit plans completed, reports issued on time, recommendations implemented, professional qualifications held by the team.
These measures remain useful. They provide evidence that an internal audit function is organised, disciplined and capable of delivering work to a professional standard. In many organisations they still form the backbone of internal audit dashboards and annual reports. However, as expectations of internal audit continue to evolve, these traditional metrics are increasingly seen as incomplete.
Boards and audit committees are asking different questions. Rather than focusing only on how much work internal audit delivers, they are asking whether the function is contributing meaningfully to governance, risk management and organisational resilience.
The Global Internal Audit Standards, introduced by the Institute of Internal Auditors, reflect this shift clearly. The standards emphasise that internal audit exists to provide assurance, advice, insight and foresight. Measuring performance therefore requires more than tracking activity levels. It requires demonstrating how internal audit work is influencing decision making and supporting the organisation’s objectives. This represents an important change in emphasis. Internal audit performance can no longer be measured solely by efficiency – It must increasingly demonstrate effectiveness and impact.
From delivery metrics to organisational value
Traditional internal audit metrics have tended to focus on operational delivery. These include indicators such as audit plan completion rates, report turnaround times, the number of findings raised and the professional qualifications held by the audit team. Such measures are straightforward to collect and provide a clear view of whether an audit function is delivering its planned programme of work. Yet they say relatively little about the broader question that matters most to boards and audit committees.
What difference did internal audit make?
- Did the work influence governance discussions?
- Did it highlight emerging risks early enough to inform management action?
- Did it contribute to improved resilience or better decision making?
These questions are more difficult to measure, but they are central to demonstrating the value of internal audit in modern organisations. The shift can be illustrated by comparing traditional internal audit performance indicators with the types of measures now emerging under the new standards.
| Traditional Internal Audit KPIs | Emerging Performance Measures |
|---|---|
| Audit plan completion | Influence on governance discussions |
| Report turnaround time | Evidence of insight and foresight |
| Number of audits delivered | Contribution to organisational resilience |
| Training and qualifications | Strategic engagement with leadership |
| Issue closure rates | Organisational action resulting from audit work |
Traditional measures primarily demonstrate efficiency and delivery. Emerging measures aim to demonstrate impact and influence. Both have a place. Internal audit functions must still deliver work effectively and reliably. However, the profession is increasingly recognising that activity alone does not demonstrate value. To show how internal audit contributes to organisational success, performance measurement must begin to capture the difference the function makes beyond the audit report itself.
The IIA Performance Measurement Tool
To support the shift toward more meaningful performance indicators, the Institute of Internal Auditors has introduced a Performance Measurement Tool aligned with the Global Internal Audit Standards.
The tool has received relatively little attention so far, yet its implications for internal audit functions are significant. It is designed to help audit teams move beyond internally focused metrics and begin demonstrating the wider organisational value of their work. Under the new standards, performance measurement is closely linked to several key areas of the framework.
- Domain I establishes the purpose of internal audit as providing assurance, advice, insight and foresight.
- Standard 12 requires internal audit functions to measure and monitor performance.
- Domain V emphasises the importance of effective execution across planning, fieldwork, reporting and follow up.
Taken together, these elements point toward a broader view of performance. Internal audit functions are encouraged to demonstrate not only that work is delivered efficiently, but also that it contributes to stronger governance, improved decision making and greater organisational preparedness.
This has practical implications for how internal audit dashboards, annual reports and audit committee papers are structured. Measures that focus solely on delivery are no longer sufficient on their own. Stakeholders increasingly expect evidence that internal audit is contributing to organisational understanding of risk and supporting proactive governance.
Paul Haley reflects on this shift in emphasis.
Paul Haley, Co-Founder, Littlechild & Haley
“For a long time internal audit performance has been measured largely through delivery metrics. How many audits were completed, whether reports were issued on time, whether the audit plan was delivered.
Those measures are still useful, but they only tell part of the story. The more important question is whether the work of internal audit is influencing how the organisation thinks about risk and governance.
If a report is delivered efficiently but nothing changes as a result, it is difficult to say that value has truly been created. Performance measurement needs to focus more on whether internal audit is prompting better conversations, highlighting emerging issues and helping leadership teams make more informed decisions.”
Measuring insight and foresight in practice
One of the most important changes reflected in the new standards is the expectation that internal audit should contribute insight and foresight, not simply retrospective assurance. This raises a practical question. How can these qualities be measured?
Insight often emerges through thematic reporting, root cause analysis and the ability to connect patterns across multiple audits. Rather than treating each audit as a separate exercise, internal audit functions increasingly look for recurring issues that reveal underlying organisational weaknesses.
Foresight goes further, it involves identifying emerging risks, challenging assumptions and helping organisations prepare for potential future pressures.
Examples of how these activities might be evidenced in practice include:
- audits incorporating analysis of emerging risks
- horizon scanning or scenario analysis informing audit planning
- thematic reports identifying patterns across several reviews
- advisory work supporting boards and executive teams
- commentary on emerging regulatory or technological developments
In many organisations these practices are still developing. However, they represent an important step in demonstrating that internal audit is contributing not only to control assurance but also to strategic understanding of risk.
Measuring organisational value
Perhaps the most difficult aspect of performance measurement is demonstrating the organisational value of internal audit. Unlike many other functions, internal audit rarely implements change directly. Management owns the controls and is responsible for making improvements. As a result, attributing financial savings or operational benefits directly to internal audit can be problematic.
Donna Littlechild notes that the value of internal audit often lies in catalysing change rather than delivering it directly.
Donna Littlechild, Co-Founder, Littlechild & Haley
“One of the challenges with measuring internal audit value is that the function rarely owns the outcome. Internal audit highlights the issue, but management implements the change.
In the past there has sometimes been a temptation to claim financial savings directly from audit work, but that can quickly become misleading. A more meaningful approach is to look at how internal audit has influenced the organisation.
Did the audit surface an issue that triggered a wider programme of improvement? Did it bring attention to a risk that had previously been underestimated? Did it help leadership teams see the implications of something more clearly?
In many cases the real value of internal audit is not the report itself but the conversation it creates and the action that follows.”
One practical way to make risks more meaningful is to connect them directly to organisational objectives and financial consequences. For example, workforce absence is often listed as a generic operational risk. When organisations quantify the financial cost of absence, the issue can suddenly take on greater strategic importance. What was previously a broad workforce risk becomes a clearly understood operational and financial exposure.
This type of thinking can help internal audit move discussions beyond abstract risk descriptions and toward issues that boards and executives recognise as strategically significant.
Capturing value over time
Another challenge is that the impact of internal audit work often becomes visible only after some time has passed. Many organisations currently use post audit surveys to gather feedback from management. While these surveys can be helpful, they often focus on immediate satisfaction with the audit process rather than the longer term effect of the work.
More meaningful insight may emerge through follow up conversations several months after an audit has concluded. Questions might include:
- What changes occurred as a result of the audit?
- Did the audit trigger wider management discussions or initiatives?
- Were additional resources or investment directed toward the issue?
- Did the audit influence strategic or governance decisions?
Capturing feedback at six or twelve months can provide a clearer picture of organisational value than immediate surveys conducted at the end of fieldwork.
Challenges in measuring internal audit performance
Despite the progress being made, performance measurement in internal audit remains challenging. Some indicators, particularly those related to influence or foresight, are inherently subjective. It can be difficult to measure how far an audit has shaped governance discussions or influenced management decisions.
There is also a risk of overstating the contribution of internal audit if measures are not carefully defined. Management retains responsibility for implementing changes, and performance measures must recognise this distinction. In addition, many internal audit functions are still developing their approaches to foresight, thematic analysis and emerging risk identification. As these practices mature, the methods used to measure them will likely evolve as well.
Recognising these limitations is important. Performance measurement should aim to provide insight rather than create artificial precision.
Examples of higher value performance indicators
The types of measures emerging under the new standards often focus on organisational impact rather than simple activity levels.
| Area | Example indicator |
|---|---|
| Emerging risk | Percentage of audits incorporating emerging risk analysis |
| Insight | Thematic reporting identifying cross organisational control issues |
| Foresight | Scenario analysis or horizon scanning presented to the board |
| Governance influence | Instances where audit work shaped strategic discussions |
| Organisational value | Management feedback on operational improvements following audits |
These measures are not intended to replace traditional indicators entirely. Instead they complement them, providing a broader picture of internal audit performance.
Looking ahead
As internal audit continues to evolve, expectations around performance measurement will also develop. Technological change is likely to accelerate this shift. As data analytics and artificial intelligence increasingly support some of the technical aspects of audit work, the distinctive value of internal audit will lie less in routine activity and more in interpretation, judgement and insight.
In that environment, internal audit functions will need to demonstrate how their work helps organisations understand risk, anticipate emerging pressures and strengthen governance. Measuring performance will therefore become less about counting the number of audits delivered and more about understanding the difference those audits make.
Internal audit has long been recognised for its role in providing assurance. Increasingly, its performance will also be judged by the insight and foresight it brings to the organisation it serves.
