maturity models21

Sanjay Kankaria

FRAST Branch MeetingJune 23 , 2008

Maturity Models and Balanced Scorecard

Frameworks For Internal Auditing

Maturity Models and Balanced Scorecard Frameworks for Internal Auditing

WHYWHY - - Maturity Models and Maturity Models and Balanced Scorecard Frameworks ?Balanced Scorecard Frameworks ?

The STRATEGICSTRATEGIC Question The VALUEVALUE Question

Are we delivering the right benefits ?

Are we doing the right things ?

Are we doing things the right

way ?

Are we doing things of right

quality?

The PROCESSPROCESS Question

The QUALITYQUALITY Question

2


Business Goals

Internal Audit Goals

Internal Audit

Processes

Translate in toCheck Alignment with

Key ActivitiesControl

Objectives

MaturityModels

BalancedScore Card

InternalAudit

Strategy Maps

Control Practices

Responsibility and

Accountability Chart(s)

Activity Goals and Metrics

Bro

ken

in

to

Assessed

by

An

aly

zed

by

Assessed by

For P

erfo

rman

ce

Cau

se a

nd

eff

ect illu

stra

ted

b

y

Con

trolle

d B

yIm

ple

men

ted

by

For M

atu

rity

Assessed

for m

atu

rity b

y

Control FrameworkControl Framework3


Business Goals


Internal Audit

Processes

Translate in toCheck Alignment with




Internal Audit

Processes

Control Objectives

Control Practices

Con

trolle

d B

yIm

ple

men

ted

by




Internal Audit

Processes

Key Activities

Responsibility and

Accountability Chart(s)

Activity Goals and Metrics

Bro

ken

in

to

Assessed

by

An

aly

zed

by




Internal Audit

Processes

MaturityModels

BalancedScore Card

InternalAudit

Strategy Maps

Assessed by

For P

erfo

rman

ce

Cau

se a

nd

eff

ect illu

stra

ted

b

y

For M

atu

rity



Maturity Models -Maturity Models -HistoryHistory

First released by Software Engineering Institute affiliated with Carnegie Mellon University in 1993 as Capability Maturity Models -CMM

First released by Software Engineering Institute affiliated with Carnegie Mellon University in 1993 as Capability Maturity Models -CMM

Information System Audit and Control Association ISACA Adopted it for Internal Auditing as COBIT in 1996

Information System Audit and Control Association ISACA refined it further in 2007

Maturity levels rated from a scale of non–existent level 0 to optimized – level 5

8


Graphic Representation of Maturity Models Graphic Representation of Maturity Models

0 2 3 4 5

Non Existe

nt

Initial /Ad hoc

Repeatable

but intuitive

Defined

Process

Managed and

Measurable

Optimized

1

Maturity Levels

0 Lack of any recognizable processes / practices

1 Processes are ad hoc and disorganized

2 Processes follow a regular pattern

3 Processes are documented and communicated

4 Processes are monitored and measured

5 Good Practices are followed and automated

9


Maturity Level

Characteristics

00 Non ExistentComplete lack of any recognizable processes

The enterprise has not even recognized that there is an issue to be addressed.

11 Initial /Ad Hoc

There is evidence that the enterprise has recognized that the issues exist and need to be addressed

There are however, no standardized processes; instead, there are ad hoc approaches that tend to be applied on an individual or case-by-case basis

The overall approach to management is disorganized.

Maturity Models Maturity Models

10


Maturity Level Characteristics

22Repeat-able but Intuitive

Processes have developed to the stage where similar procedures are followed by different people undertaking the same task.

There is no formal training or communication of standard procedures, and responsibility is left to the individual

There is a high degree of reliance on the knowledge of individuals and, therefore, errors are likely

33DefinedProcess

Procedures have been standardized and documented, and communicated through training.

It is mandated that these processes should be followed; however, it is unlikely that deviations will be detected.

The procedures themselves are not sophisticated but are the formalization of existing practices.

Maturity Models-cont’dMaturity Models-cont’d

11


Maturity Level

Characteristics

44Managed

And Measurable

Management monitors and measures compliance with procedures and takes action where processes appear not to be working effectively

Processes are under constant improvement and provide good practice

Automation and tools are used in a limited or fragmented way

55Optimized

Processes have been refined to a level of good practice, based on the results of continuous improvement and maturity modeling with other enterprises

IT tools are used in an integrated way to automate the workflow, providing tools to improve quality and effectiveness, making the enterprise quick to adapt.

Maturity Models-cont’dMaturity Models-cont’d

12


Generic Maturity Model

ISACA has proposed tracking Maturity levels of following Six Generic Aspects / Dimensions / Planes

AWARENESS AND AWARENESS AND COMMUNICATIONCOMMUNICATION

POLICIES AND PROCEDURESPOLICIES AND PROCEDURES

SKILLS AND EXPERTISESKILLS AND EXPERTISE

RESPONSIBILITY AND RESPONSIBILITY AND ACCOUNTABILITYACCOUNTABILITY

GOAL SETTING AND GOAL SETTING AND MEASUREMENTMEASUREMENT

TOOLS, TEMPLATES AND TOOLS, TEMPLATES AND AUTOMATIONAUTOMATION

Generic Maturity ModelGeneric Maturity Model

13


Balanced Scorecards - HistoryBalanced Scorecards - History

First proposed by Kaplan and Norton in an article in the Harvard Business Review in 1972.

Institute of Internal Auditors Research Foundation brought out a research publication “A Balanced Scorecard Framework for Internal Auditing departments” In 2002

American Accounting Association awarded a prize for “Most significant Contribution” in 2001

Further developed and refined the concept as Strategy Maps in 2001.

14


Mechanisms to enhance VALUEMechanisms to enhance VALUE

Book - The Discipline of Market Leaders- Michel Tracey

Operational Excellence

Customer Intimacy

Innovation

15


Balanced Scorecard Template Balanced Scorecard Template

FINANCIALS,FINANCIALS,SHAREHOLDER’SHAREHOLDER’

SSPERSPECTIVEPERSPECTIVE

GOALS MEASURES

INNOVATION, INNOVATION, FUTURE FUTURE

ORIENTATION & ORIENTATION & CAPABILITIESCAPABILITIES

GOALS MEASURES

INTERNAL, INTERNAL, BUSINESS BUSINESS

PROCESS/OPERAPROCESS/OPERATIONAL TIONAL

EXCELLENCEEXCELLENCE

GOALS MEASURES

CUSTOMER CUSTOMER PERSPECTIVEPERSPECTIVE

GOALS MEASURES

Stakeholders/

Drivers

16


Internal Audit Focus- Internal Audit Focus- Different Views of Different stakeholdersDifferent Views of Different stakeholders

RISKS & RISKS & CONTROLSCONTROLS

CONSULTINGCONSULTING

BOARD AND BOARD AND AUDITAUDIT

COMMITTEESCOMMITTEES

MANAGEMENT MANAGEMENT & OTHER & OTHER AUDITEESAUDITEES

17


Balanced Scorecard Template Balanced Scorecard Template

BOARD & AUDITBOARD & AUDITCOMMITTEES COMMITTEES

GOALS MEASURES

INNOVATION, INNOVATION, FUTURE FUTURE

ORIENTATION & ORIENTATION & CAPABILITIESCAPABILITIES

GOALS MEASURES

INTERNAL, INTERNAL, BUSINESS BUSINESS

PROCESS/OPERAPROCESS/OPERATIONAL TIONAL

EXCELLENCEEXCELLENCE

GOALS MEASURES

MANAGEMENT &MANAGEMENT &OTHER AUDITEESOTHER AUDITEES

GOALS MEASURES

Stakeholders/

Drivers

18


GOALS MEASURES RATINGThe internal audit functions maintains independence with in the organization

Independent third party’s objective evaluation of Internal Audit Independence

There will not be any control related surprises/ unexpected events for the Audit Committee

Peer Director’s objective evaluation of control surprises for the Audit committee

Regular and timely communication occurs between Internal audit and audit committee

Peer Director’s objective evaluation of regular communication with the Audit committee

The audit committee will be continuously educated about the business controls , internal audit’s role etc.

Number of educational subjects as part of Agenda in Audit Committee meetings

Internal Audit meeting the expectations of Audit committee members

Audit Committee Members Satisfaction Survey results

Board & Audit Committees - Some Possible MetricsBoard & Audit Committees - Some Possible Metrics

R Y G

R Y G

R Y G

R Y G

R Y G

19


GOALS MEASURES RATINGRATINGInternal Audit identifies Key issues

Number of major audit findings and recommendations

Internal Audit provides value added services

Amount of savings identified by the Auditing Department

Internal Audit provides value added services

Number of process improvements suggested by the Audit department

Internal Audit has client acceptability

Percent of Audit recommendations fully implemented by the auditee

Internal Audit has positive brand image

New clients added to client base

Internal Audit is responsive to clients needs

Average Response time to management requests

Management & Other Auditees- Some Possible MetricsManagement & Other Auditees- Some Possible Metrics

R Y G

R Y G

R Y G

R Y G

R Y G

R Y G

20


Goals Measures RatingRatingInternal Audit will have high productivity

Completed Audits per Auditor

Internal Audit will have high Staff Utilization

Percentage of Time spent on Projects as opposed to administrative time or vacation

Internal Audit will have low turnaround time

Days from end of field work to report issuance

Internal Audit will have high coverage of organization’s activities

Completed versus Planned Audits

Internal Audit will resolve pending issues promptly

Number of Days the issue remained open after the expected closure date

Internal Audit Processes/Operational ExcellenceInternal Audit Processes/Operational Excellence – – Some Possible MetricsSome Possible Metrics

R Y G

R Y G

R Y G

R Y G

R Y G

21


GOALS MEASURES RATINGRATING

Internal Audit will seek to develop the Human Capital of its staff

Training hours per Auditor

Internal Audit will encourage innovative practices

Number of new Audit templates developed by the Internal Audit

Internal Audit will identify and execute technological innovations

Number of new Software purchased / deployed by Internal Audit

Internal Audit staff would have proper professional competencies

Number of new Certifications acquired by Internal Audit

Internal Audit will maintain involvement interaction and thought leadership

Number of Best Practices identified and presented with in the organization

Innovation, Future Orientation & CapabilitiesInnovation, Future Orientation & Capabilities-Some Possible Metrics-Some Possible Metrics

R Y G

R Y G

R Y G

R Y G

R Y G

22


Leading/ Lagging Performance Measures Leading/ Lagging Performance Measures ContinuumContinuum

Leading Performanc

eMeasures

LaggingPerformanc

eMeasures

Training Hours

per InternalAuditor

Number of Major

Audit Findings

Percentage of Audit

Recommendations Implemented

Number of Management

Requests

Number of Process

Improvements

AuditeeSatisfaction

Survey

23


A Strategic Map for Internal Audit

24


Expectations of Management from Internal AuditExpectations of Management from Internal AuditPartner in GovernancePartner in Governance

25


Risk Related ActivitiesRisk Related Activities26


Internal Audit Role in ERMInternal Audit Role in ERM27


Alternative Performance DimensionsAlternative Performance Dimensions

1 Adequate Risk Coverage

2 Better Strategic Alignment

3 Better Customer Intimacy

4 Better Performance Management Systems

5 Operational Excellence/ Better Quality / Resource Management

6 Learning & Innovation

Contribution of Internal Audit to help Organization / Clients achieve:

Achievement of following objectives within internal Department :

R Y G

2 Better Strategic Alignment

3 Better Customer Intimacy

4 Better Performance Management Systems

5 Operational Excellence/ Better Quality / Resource Management

6 Learning & Innovation

R Y G

R Y G

R Y G

R Y G

R Y G

R Y G

R Y G

R Y G

R Y G

R Y G

28

A. Client Service Performance Measures

B. Internal performance Measures


WHYWHY - Maturity Models and - Maturity Models and Balanced Scorecard Frameworks ?Balanced Scorecard Frameworks ?

BEST BEST PRACTICESPRACTICES

Answer

STRUCTUREDNSTRUCTUREDN

ESSESS Answer

COMPLETENECOMPLETENE

SSSS Answer

OBJECTIVITYOBJECTIVITY Answer

29


30