This document outlines a presentation on implementing an internal audit (IA) balanced scorecard to measure IA effectiveness and efficiency. The presentation covers: setting the context for an IA balanced scorecard; components of an IA balanced scorecard including perspectives like audit committee, management, internal audit processes, and innovation; and identifying measurement criteria. Key points include establishing performance metrics in critical areas like stakeholder satisfaction and processes, setting a desired maturity state for the IA function, and defining an IA balanced scorecard to demonstrate IA's value and contribution to the organization.

1. Implement an IA balanced scorecard for
measuring IA effectiveness & efficiency
©The content in this presentation is copyright of SekelaXabiso CA Inc - 2017. All rights reserved.

2. • Re-cap from previous
session
• Setting the context for
IA Balanced scorecard
• Components of an IA
Balanced scorecard
• Identifying and setting
measurement criteria
© 2017 SekelaXabiso
Session Outline

3. CAE MasterClass Modules Re-Cap
Universe
Epitome of a
world class IA
Balance score
card driven IA
Transforming
Maturity of IA
for value add
Managing key
stakeholder of
an IA function
Embedding a
combined
assurance
framework
Delivering the
desired levels
of assurance
and advisory
© 2017 SekelaXabiso
• Epitome of a world-class
internal audit function;
• Develop and implement an
IA balance scorecard;
• Transforming the internal
audit value chain:
• Establish a stakeholder
relationship management
plan;
• Leveraging the benefits of a
Combined Assurance
Framework;
• Delivering the key
engagement deliverables.

4. We must understand who we are
Heightened need to create
effective performance measures
exist;
The chief audit executive (CAE)
needs to establish a process for:
• Identifying critical performance
areas such as stakeholder
satisfaction, internal audit
processes, and innovation and
capabilities; and
• Set desired maturity state of the
IA function vis a vis the world
class state.
© 2017 SekelaXabiso
• As auditors, we are not necessarily
experts at whatever it is our clients do
and we cannot be.
• We do not perform their tasks every
day.
• Our expertise is:
– risk identification;
– information solicitation;
– information/process evaluation;
– reporting the results of the
evaluation.
• If we are good at these fundamental
skills, we can succeed as auditors in
any environment.

5. Defining Value Added by IA
© 2017 SekelaXabiso
What is Value Add per IA perspective?
• For operating line managers, value add is
improved the efficiency and effectiveness of
their operations so as to meet their operating
objectives.
• For external auditor, internal audit is an
additional internal control which, if operating
effectively, can reduce the extent of the work
the external auditor must perform to issue an
opinion on the organization’s financial
statements
• For suppliers and customers, IA must provide
assurance on the reliability and security of the
information systems forming the interface with
the organization.
• For line staff, internal audit must bring them
innovations and best practices from across the
organization.
IA is considered effective
and efficient if the function
can demonstrate that:
• It has identified and
planned to address the
expectations of all its
stakeholders
• It delivers its mandate
in line with the relevant
professional standards
• It makes significant
contribution to
improving the
organisation’s business
value chain

6. Identifying our stakeholders
© 2017 SekelaXabiso
Typical IA stakeholders are internal and
external and composed of:
Internal stakeholders:
• Board of directors (inc. its committees
e.g. audit committee).
• Senior Executive management.
• Operations and support management.
• Internal assurance providers (2nd LoD).
External stakeholders:
• Regulatory bodies and standard
setters.
• External auditors.
• Third-party vendors.
• Third-party customers.

7. Pre-requisite considerations
A need to define what is IA effectiveness and efficiency:
• Effectiveness and efficiency in general refers to “the
extent to which established objectives are
achieved.”
• Internal audit must proactively establish a
mechanism to track and monitor its effectiveness
and efficiency;
• This is achieved through establishing appropriate
performance metrics and related measurement
criterion;
• Various forms of measurement or evaluation have
been established commonly in the form of a
balanced score card or questionnaires that could
help determine internal audit quality; and
• IA Balanced scorecard must form an integral part of
internal audit process.
© 2017 SekelaXabiso
Triple E’s:
Effectively
Efficiently
Economical

8. When developing performance measures, the internal audit activity should
consider:
• How effective are the performance measures linked to the internal
audit activity’s strategy?
• Do performance measures include both leading and lagging
indicators?
• Do performance measures reflect the mandate and role of the
activity?
• How effectively are performance measures used for continuous
improvement?
• Performance metrics can be established along dimensions, interests,
and perspectives of a variety of key stakeholders.
© 2017 SekelaXabiso
Pre-requisite considerations cont’d

9. Performance categories to measure
• Thought
Leadership &
Innovation
• Management
& auditees
• Internal Audit
Processes
• Audit
committee
30% 25%
15%30%
© 2017 SekelaXabiso
Source: Adapted from A Balanced Scorecard Framework for Internal Auditing Departments, by Mark Frigo.

10. Audit Committee perspective
© 2017 SekelaXabiso
Audit Committee(30%):
• Alignment of IA strategy as well as its execution plan to organisational strategy;
• Achievement of key goals and objectives set out per IA Strategy Plan
• Significant risks addressed by planned projects ≥100%;
• Percentage of IA personnel equipped with relevant designations 75%;
• Planned projects timely completed within allocated budget ≥95%;
• Audit effort dedicated to “value adding“ audits – 60%;
• Number of issues raised in draft report versus issues in final report >90%;
• Timely and complete closeout of reports >90%;
• Extent to which IA achieves its deliverables per Combined Assurance Plan (e.g.
reliance by other assurance providers such as Legislators, external auditors etc.)
≥ 100%;
• Number of professional development, technical updates or refresher sessions
shared with Audit Committee
• Overall AC Evaluation score >4.

11. Management & auditee perspective
© 2017 SekelaXabiso
Management (30%)
• Extent of implementation of IA recommendations ≥90%;
• Organisational maturity & awareness of IA value contribution 4 of 5;
• Level of contribution to the improvement of risk management, control, and
governance processes (improvement in Organisation’s Risk Management
index, governance maturity index and Controls index) positive trend in index;
• Extent of stakeholder acknowledgement of IA contribution (stakeholder
surveys) to measure effectiveness in meeting stakeholders’ needs;
• Percentage of IA effort or resources dedicated for consulting and advisory
interventions 25%;
• Extent of consulting engagements proposed and accepted by stakeholders;
• Mission critical Processes targeted for major improvement versus those
completed;
• Extent of costs savings quantified as a percentage or amount 5%.

12. Internal Audit Processes perspective
© 2017 SekelaXabiso
Internal Audit processes (25%)
• IA function “as is” maturity vis a vis desired maturity level 4 of 5;
• Team productivity on execution of IA plan >85%;
• Use of data analytics on the project ≥30% of budgeted hours;
• IA Compliance index to track and measure adequacy of engagement planning
and supervision (files and work papers peer-reviewed (internal or external) for
compliance with IIA standards every quarter)100% file reviews within 10 days of
completing fieldwork;
• Peer review average score of >4 of 5 per team;
• Number of individuals with timely engagement reviews - 90%;
• Average competency score based on engagement reviews >4 score (of 5);
• Attendance to specific learning & development initiatives >95% targeted group;
• Frequency with which IA Plan is revisited for emerging risks once every quarter;
• Individuals achieving their CPD set targets >100%;
• Climate survey average score of >4 (of 5); and
• Feedback score from other 2nd, 3rd and 4th LoD assurance providers >4 (of 5).

13. Thought Leadership & Innovation perspective
© 2017 SekelaXabiso
Innovation and thought leadership (25%)
• Thought leader interventions or strategic improvement ideas researched
and accepted by stakeholders;
• Number of thought leadership interventions proposed to and accepted
for implementation by management ;
• Percentage of audit effort (hours & resources) dedicated for innovation
and thought leadership sessions;
• Professional development sessions tailored for the organisation and
facilitated by Internal Audit;
• Stakeholder feedback on quality of innovation and thought leadership
interventions;
• Specialised training on innovation and thought leadership afforded to
each member of IA team 4 hours per quarter.

14. Provide assurance on Value Creation
© 2017 SekelaXabiso
Value
OpportunityRisk
World class audit function
delivers audits geared
towards identifying:
• revenue opportunities;
• cost recovery;
• discovering cost
avoidance opportunities;
• measuring hours of
efficiency opportunity and
direct redeployed savings;
• quantified or untapped
growth opportunity; and
• determinable risk
reduction.

15. Gearing up IA to achieve a healthy
scorecard – next session
Governance
People
Methods &
Practices
Communicati
on & Reporting
Information &
Systems
© 2017 SekelaXabiso
Governance – is the key enabler to all other
components as it set the tone at the top, the
vision, mission and the culture of entire IA
value chain;
People - is the key value add pillar that brings
to live, the mission, vision, culture and the
tone at the top;
Methods & Practices – forms the basis for
policies, procedures, methodology, tools and
practices used in executing the IA mandate;
Communication & Reporting – a fundamental
pillar that brings the value added by the IA to
the attention of the key stakeholders; and
Information & Systems – the fundamental
pillar that drive the quantity and quality of
data, information and systems on which IA
leverage in delivering their mandate.
IA functional maturity transformation

16. Thank You!