The internal audit KPIs worth reporting are the ones that show whether the team delivered its plan, finished work on time, got findings acted on, and was useful to the people it audited. A few well-chosen measures reported every quarter beat a dashboard of twenty numbers nobody reads.
Last reviewed: 17 October 2026. Facts checked. We searched for how councils and training providers report internal audit performance (plan completion, recommendations agreed and implemented, stakeholder feedback) and for how the IIA links performance metrics to the quality programme. We did not open the full reports and we give no benchmark targets, because the ones we saw vary widely between organisations.
Why measure internal audit at all
The audit committee asks others to show results. It should expect the same of internal audit. Metrics also help the head of internal audit spot problems early, such as reports that take too long or actions that never close.
There is a trap. Any number you track will shape behaviour. If you reward "number of observations raised", auditors raise trivial ones. Pick measures that push towards good work.
The four groups of measures
Public-sector scorecards and training guides tend to group measures in similar ways. A simple version:
| Group | What it answers |
|---|---|
| Delivery | Did we do the work we promised? |
| Timeliness | Did we do it on time? |
| Impact | Did anything change because of us? |
| Stakeholder view | Did the people we audited find it useful? |
Delivery measures
Plan completion. Percentage of planned audits finished, or at least started, in the period. Report it with reasons for changes. A plan that changed because the risks changed is a good sign, not a failure.
Coverage of high-risk areas. Of the areas you rated high-risk in the audit universe, how many were audited in the cycle you set?
Resource use. Actual hours against budget hours for each audit. Big gaps point to poor scoping or poor estimates.
Timeliness measures
- Days from fieldwork end to draft report.
- Days from draft to final report.
- Days management takes to respond.
Split the last one out. If delays sit with management, the audit committee should see that, not blame internal audit.
Impact measures
This is where most teams are weakest, and where the audit committee cares most.
Recommendations agreed. The share of observations management accepts. A very low rate can mean weak findings. A rate of 100 per cent every time can mean the findings are too soft.
Recommendations implemented on time. Of the actions agreed, how many closed by the committed date? Show ageing: how many are overdue by 30, 60 or 90 days. Our action taken report tracker is built for this.
Repeat observations. How many findings are the same as last year's? A rising number says fixes are not holding.
Value delivered. Savings found, leakages stopped, or losses avoided, only where you can evidence them. Do not guess.
Stakeholder measures
Post-audit feedback. A short survey after each audit: was the scope clear, were the auditors professional, were the findings fair, were the recommendations practical? Keep it to five questions and report the average.
Audit committee feedback. Ask the committee once a year how useful the reports are.
Quality measures
These link to your quality programme, covered in our guide to the quality assurance and improvement programme.
- Share of audit files that pass a supervisor or peer review first time.
- Number of audit files with missing evidence.
- Training hours and certifications held by the team.
- Share of reports issued without material correction after release.
Example scorecard
| Measure | How to read it | Frequency |
|---|---|---|
| Plan completion | Done vs planned, with reasons | Quarterly |
| Draft report timeliness | Days after fieldwork | Quarterly |
| Actions closed on time | Closed vs due | Quarterly |
| Overdue actions by age | Count in each age band | Quarterly |
| Repeat observations | Count and share | Annual |
| Stakeholder score | Survey average | Per audit |
| File review pass rate | First-time passes | Quarterly |
You can pull several of these together with the internal audit dashboard pack generator.
How to set targets
Do not borrow targets from another organisation. Look at your own last two years, set a modest improvement, and agree it with the audit committee. A target should be reachable and should make sense for your size and mix of work.
Common mistakes
- Counting observations as a success measure.
- Reporting only activity (audits done), not outcomes (risks reduced).
- Hiding delays that sit with management.
- Changing measures every year, so trends cannot be seen.
- Skipping the qualitative story. A paragraph on what changed beats a table.
Frequently Asked Questions
How many KPIs should internal audit track?
Six to ten is enough for most teams. More than that and the committee stops reading.
Should we report the number of observations raised?
Report it as context, not as a target. Counting findings rewards volume over importance.
What is a good plan completion rate?
It depends on how often the plan changes for good reasons. Agree a target with the audit committee and report variances with explanations rather than chasing a fixed percentage.
Who should see the KPIs?
The audit committee, the head of internal audit and senior management. Teams often also share a short version with auditees.
Are KPIs the same as quality measures?
They overlap. KPIs show performance. Quality measures show whether work meets professional standards. Both belong in the same dashboard.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error