The CAE budgets approximately 80 percent of the internal audit staff time for
projects identified through the risk assessment process, leaving 20 percent of their time open for emerging priorities. In its first year, the department received a large number of requests from the
business unit customers for other projects, and that was clearly viewed by the audit committee as
a substantial measure of success.
During the meetings with the audit committee, the CAE also reports the percentage of
completion of the audit plan, although this is not the primary measure of the IAD’s success since
the department is intended to address risk as it arises. Consequently, the annual internal audit plan
is considered to be flexible as it may be revisited on occasion throughout the year and changed as
particular needs dictate.
Another major measure of success has been the open acceptance of the department by the
business units and their willingness to work with the internal auditors. During the audits scheduled
through the risk assessment process, company personnel were willing to offer ideas on areas that
they thought they could use additional audits. Several personnel called the internal auditors for
assistance as events occurred during the year. For additional monitoring of the effectiveness of the
department, the CAE recently implemented a 9-question internet-based audit client survey that is
used to gather input and feedback from the audit customers on each of their audit projects (see
Exhibit 10).
As time passes and the IAD becomes more established, other metrics of success will
probably be developed, such as the percentage of audit recommendations implemented by the
various business units.