By: TORBEN HILBERTZ, CIA, is Senior Vice President Internal Audit at Abu Dhabi Airports Company


Should an Internal Audit report cost more than a brand-new Porsche 911? This is the story of how Abu Dhabi Airports Company (ADAC) transformed its internal audit department through innovative management and measurement of performance.

Would you be ready to pay a higher price for an ordinary Internal Audit report than you would be willing to pay for a brand-new Porsche 911? Do you think that your Audit Committee would be ready to pay that price? Ask yourself what the average cost of an Internal Audit report in your department is (as a rule of thumb, just divide the annual Internal Audit budget by the number of Internal Audit reports issued during a year). Once you have determined the average cost of an Internal Audit report, ask yourself whether you are in a good position to compete with possible outsourcing alternatives. Then assess whether your departmental strategy and business model sufficiently considers competitiveness and performance.

For most organisations it is mandatory to satisfy the need of having an Internal Audit department. However, this requirement might also be satisfied by outsourcing that responsibility to a professional audit firm (e.g. to a Big-4 company). A successful Chief Audit Executive who wants to keep most Internal Audit activities in-house and who wants to be competitive (compared to possible outsourcing solutions) should therefore think of a efficient Internal Audit strategy and business model in order to stay in business (and safeguard the jobs of his team members).

What do the Institute of Internal Auditors (IIA) Standards tell us? 

The IIA Standard 1300 “Quality Assurance and Improvement Program” states that “The Chief Audit Executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity”. In its interpretation, the IIA adds “…The program also assesses the efficiency and effectiveness of the internal audit activity and identifies opportunities for improvement”.

An approach to manage and measure Internal Audit performance should therefore (amongst others) contain the following:

  • A small number of defined key targets focused on Internal Audit adding value and improving its operations;
  • These targets should follow the SMART (Specific, Measurable, Attainable, Realistic and Timely) rule;
  • Targets should be made simple so that all can understand them;
  • Targets should include stakeholder feedback; and
  • Targets and achievement should be communicated inside and outside the team.

Internal Audit Strategy & Business Model  

ADAC Internal Audit has opted for being highly competitive and to reflect that choice in the Internal Audit strategy & business model. This competitiveness is considerably linked to the ability to manage an Internal Audit department in the same way a Big-4 Partner manages his team, hence focusing on effectiveness, efficiency and cost.  Unlike in the case of outsourcing, no additional profit margin is added to the actual cost of Internal Audit resources. Both, the Internal Audit Strategy & Business Model are clearly guided by the main principle which is adding value to ADAC.

The main focus of the Internal Audit Business Model, which supports the organisation’s overall strategy, is on the following main areas:

  • Add value to ADAC;
  • Be cost efficient (costs per IA Report need to be competitive);
  • Focus on topics / processes of most interest for ADAC;
  • Increase audit days / year by reducing admin time;
  • Shorten audit cycle times (IA Report to be issued shortly after the audit closing);
  • Include more top management tailored information in IA Reports; and
  • Become a valued business partner over time.

It goes without saying that performance targets and key performance indicators (KPIs) are linked to the business model:

  • Management Satisfaction (satisfaction survey results to be monitored);
  • Time between the end of fieldwork and IA Report distribution (target: < 5 days);
  • Direct audit time / available time (increase direct audit time to > 75%);
  • Percentage of closed audit recommendations;
  • Completion of the Annual Audit Plan (> 75%); and
  • Number of audits per auditor per year (to be increased over time).

One crucial element of the Internal Audit Business Model consists in making more time available for value adding activities (real internal audit work). This increase of the time spent by individuals on audit projects can be reached via reduction of administrative time as well as by an improved Internal Audit planning process that allocates time budgets as well as start and end days for each audit. Additionally, short Internal Audit report cycle times help individuals to better focus on single projects instead of keeping multiple balls in the air, simultaneously.

Management & Measurement of Internal Audit Performance 


The author is convinced of the old management adage “You Can’t Manage What You Don’t Measure”. Following that adage in combination with the Balanced Scorecard approach (translated and tailored to the Internal Audit needs), a set of KPIs that contributes to the achievement of strategic goals, was defined for ADAC’s Internal Audit department that is shown below:



Individual goals and objectives for all Internal Audit team members were logically derived from the departmental goals and objectives. The regular tracking of KPIs was started immediately as follows.

  • KPIs shared on a monthly basis
    • Audit plan completion as a percentage;
    • Number of audit report issued; and
    • Communication of KPIs to Audit Committee & C-level management.
  • KPIs tracked on a monthly basis
    • Auditee satisfaction;
    • Time budgets (actual vs. plan) per audit;
    • Time between closing meeting and report distribution;
    • Training days; and
    • Sharing of KPIs within Internal Audit Team.
  • KPIs tracked bi-annually or annually
    • Implementation rate of audit issues;
    • Management satisfaction;
    • Audit Committee satisfaction; and Further KPIs.
  • Current KPI results were shared within the Internal Audit team on a monthly basis as well as disclosed to the Audit Committee during regular meetings.Although the defined goals and objectives for 2014 (the year the new approach was adopted) appeared challenging, no single objective was missed thanks to the work of a great team. The achievement of the 2014 goals and objectives is shown in the table below. In subsequent years, the departmental performance could be increased, again

2ndProfessional Communication and Marketing of Internal Audit Activities 

How big would the benefit of a high performing Internal Audit department be if that performance would not be visible within the organisation? Especially when a wish to further improve the reputation of Internal Audit exists, professional communication and marketing of Internal Audit activities and achievements is an important element for the recognition of Internal Audit as value adding partner throughout the organisation.

The right Internal Audit report template can play a considerable role in an effective reporting of Internal Audit observations to the Audit Committee and management. Reporting to top management in a “top management language” rather than in an “auditor’s language” might be another benefit. As the real identification of adding value happens during the pure Internal Audit fieldwork, the right template can free time for the real audit work (e.g. by reducing the necessary time for report writing).

For that reason, the SVP Internal Audit started an active communication with Internal Audit stakeholders upon his arrival. The first meetings were used to market the Internal Audit approach (via a professional presentation), to ensure an alignment of expectations as well as to create a common understanding of roles and responsibilities. At the same time, an audit risk heat map was presented and introduced that aims at being an objective rating criteria for Internal Audit Observations, which formed an integral part of the revised Internal Audit report format.

The Senior Vice President Internal Audit started sharing one-paged monthly Internal Audit activity reports with the Audit Committee and top management. These monthly activity reports :

  • Summarise key Internal Audit activities of the completed month;
  • Indicate key Internal Audit activities planned for the coming month;
  • Show progress in terms of Audit Plan completion and number of IA Reports issued; and
  • Share Executive Summaries of IA reports during the month.

In addition to this, Internal Audit performance was also made visible by sharing the Internal Audit KPIs to the Audit Committee and top management.

Moreover, the 2014 (and subsequent years) Internal Audit contribution was – upon the successful achievement of all departmental goals and objectives – summarized on a single page and presented to the Audit Committee and top management.



As management and measurement of Internal Audit performance is an on-going process, the successful achievement of defined goals and objectives should motivate for reaching the next level via continuously aiming for improvement.


The ADAC Internal Audit performance management approach and characteristics can be described as follows:

  • Active Internal Audit performance management;
  • Transparency of Internal Audit KPIs within and outside the department;
  • Management tailored audit reports, easy to read – highly appreciated by top management;
  • Distribution of audit report: on average 3 days or less after the closing meeting; and
  • Strong focus on main business processes.


Within less than one year after the start of the current SVP Internal Audit, ADAC Internal Audit was able to increase its productivity by focusing on both quality and quantity. Simultaneously, cycle times for the final report issuance could be significantly reduced. With such an approach, ADAC Internal Audit had a successful take off and elevated its perception with all key stakeholders. So is ADAC internal audit paying more for an internal audit report than a brand-new Porsche 911?  Definitely not!