Practical guide · Stage: Outcome
How to measure internal audit effectiveness beyond plan completion
By Tim Buckley, Founder of Beyond the Lines™ ·
Measure internal audit effectiveness by combining delivery and quality measures with evidence of useful assurance, better-informed decisions, clear ownership and change. Plan completion shows how much agreed work was delivered. Understanding its value also requires examining what stakeholders learned, decided and did, while being careful about the outcomes audit can credibly claim.
A team can complete its plan while important findings repeatedly return. Equally, a team may adapt its plan because an emerging risk matters more. The percentage alone cannot tell you which team exercised better judgement.
The starting question is: what should this function help the organisation achieve, given its mandate and the risks that matter?
Define effectiveness before choosing measures
Agree a small set of performance objectives with appropriate board and management input. Be specific about the decisions, assurance needs and improvements that matter. Keep independence, coverage and quality visible alongside influence and stakeholder experience.
The IIA’s Standard 12.2 requires objectives and a methodology for assessing performance, consideration of board and senior management expectations, appropriate feedback and action on improvement opportunities. It does not prescribe one universal dashboard.
Use measures that answer different questions
| Question | Possible measure | Interpretation limit |
|---|---|---|
| Did we deliver relevant coverage? | Delivery against the current risk-based plan, with changes explained | Completion alone does not establish quality or continuing relevance |
| Was the work dependable? | Quality review themes and resolution of significant review points | Counting fewer review points can discourage challenge |
| Did insight inform decisions? | Documented decisions in which audit evidence was considered | Consideration does not prove agreement or a better outcome |
| Is responsibility clear? | Significant actions with an accountable owner and defined evidence of completion | An assigned name does not establish capacity or commitment |
| Did practice change? | Follow-up evidence of the intended process or control change | A limited sample may not show sustained performance |
| Is the organisation better placed? | Relevant risk or performance indicators, alongside other contributing factors | Improvement after an audit does not prove that audit caused it |
Choose measures because you will use them. A large dashboard can consume time needed to understand why important issues remain unresolved.
Follow the assurance through to its effect
The Beyond the Lines Assurance to Action System™ provides a useful enquiry:
Insight → Message → Decision → Ownership → Action → Movement → Outcome
Insight is what the evidence reveals. Message makes its relevance understandable. Decision establishes a response. Ownership identifies accountability. Action implements that response. Movement shows what has changed in practice. Outcome considers the effect on organisational objectives or risk.
Use the chain to locate the Assurance Impact Gap: where useful assurance stops translating into organisational impact. Use enough evidence to identify where attention would make a difference, without a separate KPI for every stage.
Worked example: recurring access exceptions
Illustrative example, not a client result. An audit finds repeated delays in removing access when people leave.
| Evidence available | Defensible conclusion |
|---|---|
| The report was issued within the agreed timetable | The reporting milestone was met |
| Management used the evidence to approve a revised leaver process | Audit informed a documented decision |
| Follow-up found the revised process operating for the cases examined | There is evidence of implementation within the scope tested |
| Comparable management data shows fewer overdue removals | Performance improved during the measured period; the contribution of audit needs context |
A credible account would explain that audit identified the weakness, management changed the process and subsequent evidence showed improvement. It would also identify other changes, such as new HR software, that may have contributed.
Avoid converting an assumed avoided loss into a financial benefit without a defensible basis. A candid explanation of contribution is more useful than a precise-looking number built on speculation.
Start with a manageable review
Select three significant engagements from the last six months. For each, capture the assurance provided, decisions informed, owner response and available evidence of change. Include work that confirmed controls were operating well, not just engagements that produced findings.
Look for patterns. Perhaps management understands the findings but cannot agree ownership. Perhaps actions are completed but the team cannot demonstrate what changed. Let that evidence shape the next improvement objective. The guide on internal audit action closure evidence covers that second pattern in more detail.
Common questions
Should we stop reporting plan completion?
Keep it where it helps explain delivery and resource use. Show the current approved plan, material changes and gaps in coverage so the percentage has context.
Is stakeholder satisfaction a good effectiveness measure?
It is useful feedback on relevance, clarity and working relationships. Interpret it alongside evidence of quality and independent challenge. A difficult but necessary finding may be unpopular.
Does every audit need a measurable financial benefit?
No. Useful assurance can support confidence in existing controls, expose uncertainty or inform a decision without producing a defensible cash benefit. Describe that value and its evidence clearly.
Find your starting point
Take the Assurance Impact Scorecard to reflect on where assurance may be losing impact and choose a focused next step. Use it as a practical starting point for discussion alongside your function’s formal performance and quality assessment.