PERFORMANCE MANAGEMENT: LET INTERNAL AUDIT DO IT

Call it an intrusion in what’s classically the Human Resources domain or an extrusion of the typical Internal Audit scope but to me it’s about improvement and value addition because that’s what internal audit does and there’s nothing “typical” about Internal Auditing!

While remaining within the professional confines of the standards (Global Internal Audit Standards as they’re called now), the Internal Audit is meant to be boundless in its scope, reach, expertise and energy to be able to add value and improve an organization’s operations.

But performance management is essentially a management function so how could internal audit drive it without infringing upon its coveted independence? Well, with some sound understanding of the process and the safeguards available, it isn’t that hard to grasp, that internal audit can add real value to it.

In fact, as we will see in a while, it is the internal audit’s independence, that makes it a promising entity in performance management. But let’s first see, why Internal Audit should encroach upon the performance management domain.

Well, one might not agree on a standard performance management definition but can agree on the common features that constitute it; monitoring and evaluating people performance aligned to the organization’s objectives. Let’s just start there.

Performance Management Objectives

Here’s how, the objectives of performance management relate to internal auditing:

 Performance Management is Risk Management

• Employee performance targets are metrics used for evaluating their performance. These targets are established through alignment with entity’s overall objectives.
• The objectives are what an entity’s exists and vies to achieve.
• Risk is the effect of uncertainty on these objectives.
• Risk Management system aims to mitigate the effects of risks so that objectives could be achieved.
• Performance Management system aims to ensure that employees performance remains glued to their targets so that objectives are accomplished.

Thus, performance management is risk management and internal auditing helps evaluate and improve the effectiveness of risk management!

Performance Management is Control

• Performance Management aims to control employee performance by setting performance metrics.
• Performance Management aims to control employee performance by establishing monitoring and evaluation system.
• Risks to the objectives and to performance targets are sought to be controlled through Performance Management system.

Thus, performance management is control and internal auditing helps evaluate and improve the effectiveness of control!

Performance Management is Governance

• Entity’s Board provides governance by establishing the entity’s objectives for performance management.
• Governance is provided by establishing the performance management system and policies, essentially defining all facets of the system.
• Performance Management governs the employees’ performance aligned with the objectives.

Thus, performance management is governance and internal auditing helps evaluate and improve the effectiveness of governance!

Refer to the definition of internal auditing if there are any doubts about its role in risk management, control and governance.

So now the real question is, how and why performance management is still not within the scope of work of internal auditing? Also, if performance management is best conducted through an objective approach and by an independent entity, isn’t internal auditing owing to its objectivity, independence and professionalism requirements the best option to be relied upon for this purpose?

Indeed, it is and let’s now delve into how internal audit could do this. Internal Audit

• Reviews and provides advisory on the objectives determination and targets setting framework.
• Reviews and advises on the coverage of and alignment between targets and objectives.
• Helps formulate the target implementation tasks and plan.
• Helps determine what would constitute performance against the plan and thus the target.
• Helps determine the evaluation criteria against the targets.
• Helps establish the frequency of monitoring and evaluation and the mechanism to achieve these like dashboards, etc.
• Independently evaluates the accomplishments of employees against the targets through the already established criteria and tasks implementation plan.
• Reports the accomplishments and having these jointly reviewed by the operational managers and HR.
• Extracts the lessons learnt through the annual run of the performance management system and incorporates these to review and improve the next year’s performance targets.
• Determines operating environment changes to help improve next year’s performance targets.
• Determines aspects for continual improvement in the overall performance management system.

And now let’s touch upon the safeguards:

Championing Performance Management

The Internal Audit role is that of a facilitator and coordinator. It’s like championing the cause of performance management driven cultural evolution in the entity. From objectives determination to targets setup, from advising alignment to identifying implementation plan, from specifying evaluation basis to establishing monitoring and evaluation system, internal audit provides leadership and facilitation for joint reviews, consensus and finalization.

Once finalized, internal audit would simply evaluate the data being fed to substantiate accomplishment against key assertions of relevance, accuracy, completeness and occurrence and once that’s done, the data is preferably fed into an application for evaluation against the established and pre-fed criteria. The data evaluation part could also be automated once assurance is built over internal controls for instance, IT general controls, logical controls and application controls and development of data export checkpoints.

The reporting and continual improvement parts are already classic internal audit domains!

Internal Audit’s own performance

Another important safeguard is the internal audit’s own performance metrics. To ensure objectivity and independence, the internal audit’s performance is always evaluated by the Board or even externally.  This should also be against well defined targets, evaluation criteria and sufficient, reliable data.

The internal audit’s performance in the specific domain of performance management could also be evaluated through targets specifying degree of entity’s objectives accomplishment, degree of deviation of individual results with entity’s results, degree of improvement on a year-on-year basis and others.

As for our colleagues in human resources to whom this might seem a turf invasion, well, be mindful that objectively and independently bringing a systematic and disciplined approach to improvement and optimization is internal auditing’s core domain.

In that perspective there isn’t a turf, we won’t invade. So, let’s join competencies for a bigger cause!