Implement an IA balanced scorecard for

measuring IA effectiveness & efficiency

©The content in this presentation is copyright of SekelaXabiso CA Inc - 2017. All rights reserved.

• Re-cap from previous

session

• Setting the context for

IA Balanced scorecard

• Components of an IA

Balanced scorecard

• Identifying and setting

measurement criteria

© 2017 SekelaXabiso

Session Outline

CAE MasterClass Modules Re-Cap

Universe

Epitome of a world class IA

Balance score card driven IA

Transforming Maturity of IA for value add

Managing key stakeholder of an IA function

Embedding a combined assurance framework

Delivering the desired levels of assurance and advisory

© 2017 SekelaXabiso

• Epitome of a world-class

internal audit function;

• Develop and implement an

IA balance scorecard;

• Transforming the internal

audit value chain:

• Establish a stakeholder

relationship management

plan;

• Leveraging the benefits of a

Combined Assurance

Framework;

• Delivering the key

engagement deliverables.

We must understand who we are

Heightened need to create

effective performance measures

exist;

The chief audit executive (CAE)

needs to establish a process for:

• Identifying critical performance

areas such as stakeholder

satisfaction, internal audit processes, and innovation and

capabilities; and

• Set desired maturity state of the

IA function vis a vis the world

class state.

© 2017 SekelaXabiso

• As auditors, we are not necessarily

experts at whatever it is our clients do

and we cannot be.

• We do not perform their tasks every

day.

• Our expertise is:

– risk identification;

– information solicitation;

– information/process evaluation;

– reporting the results of the

evaluation.

• If we are good at these fundamental

skills, we can succeed as auditors in

any environment.

Defining Value Added by IA

© 2017 SekelaXabiso

What is Value Add per IA perspective?

• For operating line managers, value add is

improved the efficiency and effectiveness of

their operations so as to meet their operating objectives.

• For external auditor, internal audit is an

additional internal control which, if operating effectively, can reduce the extent of the work

the external auditor must perform to issue an

opinion on the organization’s financial

statements

• For suppliers and customers, IA must provide

assurance on the reliability and security of the

information systems forming the interface with the organization.

• For line staff, internal audit must bring them

innovations and best practices from across the

organization.

IA is considered effective

and efficient if the function

can demonstrate that:

• It has identified and

planned to address the

expectations of all its

stakeholders

• It delivers its mandate

in line with the relevant

professional standards

• It makes significant

contribution to

improving the

organisation’s business

value chain

Identifying our stakeholders

© 2017 SekelaXabiso

Typical IA stakeholders are internal and

external and composed of:

Internal stakeholders:• Board of directors (inc. its committees

e.g. audit committee).

• Senior Executive management.

• Operations and support management.

• Internal assurance providers (2nd LoD).

External stakeholders:• Regulatory bodies and standard

setters.

• External auditors.

• Third-party vendors.

• Third-party customers.

Pre-requisite considerations

A need to define what is IA effectiveness and efficiency:

• Effectiveness and efficiency in general refers to “the

extent to which established objectives are

achieved.”

• Internal audit must proactively establish a

mechanism to track and monitor its effectiveness

and efficiency;

• This is achieved through establishing appropriate

performance metrics and related measurement

criterion;

• Various forms of measurement or evaluation have

been established commonly in the form of a

balanced score card or questionnaires that could

help determine internal audit quality; and

• IA Balanced scorecard must form an integral part of

internal audit process.

© 2017 SekelaXabiso

Triple E’s:

Effectively

Efficiently

Economical

When developing performance measures, the internal audit activity should

consider:

• How effective are the performance measures linked to the internal

audit activity’s strategy?

• Do performance measures include both leading and lagging

indicators?

• Do performance measures reflect the mandate and role of the

activity?

• How effectively are performance measures used for continuous

improvement?

• Performance metrics can be established along dimensions, interests,

and perspectives of a variety of key stakeholders.

© 2017 SekelaXabiso

Pre-requisite considerations cont’d

Performance categories to measure

• Thought Leadership & Innovation

• Management & auditees

• Internal Audit Processes

• Audit committee

30% 25%

15%30%

© 2017 SekelaXabiso

Source: Adapted from A Balanced Scorecard Framework for Internal Auditing Departments, by Mark Frigo.

Audit Committee perspective

© 2017 SekelaXabiso

Audit Committee(30%):

• Alignment of IA strategy as well as its execution plan to organisational strategy;

• Achievement of key goals and objectives set out per IA Strategy Plan

• Significant risks addressed by planned projects ≥100%;

• Percentage of IA personnel equipped with relevant designations 75%;

• Planned projects timely completed within allocated budget ≥95%;

• Audit effort dedicated to “value adding“ audits – 60%;

• Number of issues raised in draft report versus issues in final report >90%;

• Timely and complete closeout of reports >90%;

• Extent to which IA achieves its deliverables per Combined Assurance Plan (e.g.

reliance by other assurance providers such as Legislators, external auditors etc.)

≥ 100%;

• Number of professional development, technical updates or refresher sessions

shared with Audit Committee

• Overall AC Evaluation score >4.

Management & auditee perspective

© 2017 SekelaXabiso

Management (30%)

• Extent of implementation of IA recommendations ≥90%;

• Organisational maturity & awareness of IA value contribution 4 of 5;

• Level of contribution to the improvement of risk management, control, and

governance processes (improvement in Organisation’s Risk Management

index, governance maturity index and Controls index) positive trend in index;

• Extent of stakeholder acknowledgement of IA contribution (stakeholder

surveys) to measure effectiveness in meeting stakeholders’ needs;

• Percentage of IA effort or resources dedicated for consulting and advisory

interventions 25%;

• Extent of consulting engagements proposed and accepted by stakeholders;

• Mission critical Processes targeted for major improvement versus those

completed;

• Extent of costs savings quantified as a percentage or amount 5%.

Internal Audit Processes perspective

© 2017 SekelaXabiso

Internal Audit processes (25%)

• IA function “as is” maturity vis a vis desired maturity level 4 of 5;

• Team productivity on execution of IA plan >85%;

• Use of data analytics on the project ≥30% of budgeted hours;

• IA Compliance index to track and measure adequacy of engagement planning

and supervision (files and work papers peer-reviewed (internal or external) for

compliance with IIA standards every quarter)100% file reviews within 10 days of

completing fieldwork;

• Peer review average score of >4 of 5 per team;

• Number of individuals with timely engagement reviews - 90%;

• Average competency score based on engagement reviews >4 score (of 5);

• Attendance to specific learning & development initiatives >95% targeted group;

• Frequency with which IA Plan is revisited for emerging risks once every quarter;

• Individuals achieving their CPD set targets >100%;

• Climate survey average score of >4 (of 5); and

• Feedback score from other 2nd, 3rd and 4th LoD assurance providers >4 (of 5).

Thought Leadership & Innovation perspective

© 2017 SekelaXabiso

Innovation and thought leadership (25%)

• Thought leader interventions or strategic improvement ideas researched

and accepted by stakeholders;

• Number of thought leadership interventions proposed to and accepted

for implementation by management ;

• Percentage of audit effort (hours & resources) dedicated for innovation

and thought leadership sessions;

• Professional development sessions tailored for the organisation and

facilitated by Internal Audit;

• Stakeholder feedback on quality of innovation and thought leadership

interventions;

• Specialised training on innovation and thought leadership afforded to

each member of IA team 4 hours per quarter.

Provide assurance on Value Creation

© 2017 SekelaXabiso

Value

OpportunityRisk

World class audit function

delivers audits geared

towards identifying:

• revenue opportunities;

• cost recovery;

• discovering cost

avoidance opportunities;

• measuring hours of

efficiency opportunity and

direct redeployed savings;

• quantified or untapped

growth opportunity; and

• determinable risk

reduction.

Gearing up IA to achieve a healthy scorecard – next session

Governance

People

Methods & Practices

Communication & Reporting

Information & Systems

© 2017 SekelaXabiso

Governance – is the key enabler to all other components as it set the tone at the top, the

vision, mission and the culture of entire IA

value chain;

People - is the key value add pillar that brings to live, the mission, vision, culture and the

tone at the top;

Methods & Practices – forms the basis for policies, procedures, methodology, tools and

practices used in executing the IA mandate;

Communication & Reporting – a fundamental pillar that brings the value added by the IA to

the attention of the key stakeholders; and

Information & Systems – the fundamental pillar that drive the quantity and quality of

data, information and systems on which IA

leverage in delivering their mandate.

IA functional maturity transformation

Thank You!