How to Gauge the Audit Department?

By Arif Zaman , Head of Internal Audit, Emaar Industries & Investments, UAE


Lead by example – Audit yourself before auditing others!

Internal Audit (IA) Department is no different than any other department in the organization. There are things which influence the performance of the IA department, some are controllable factor and some are not but there are always ways to improve the performance of the IA department by enhancing its process maturity.


“I have been approached by many internal auditors, the first concern they raise is about the budget constraint but in this article, I shall be stating that this could be only one factor but there are numerous other factors by which the internal audit functional maturity can be enhanced.”


Now the question arises how to gauge the process maturity of the IA department? The answer is simple, it can be done in many ways such as by benchmarking your audit function with other good performing companies’ IA department or If you are working within a large Group, then benchmark can be done within the Group by comparing to other Group entities’ Internal Audit set-up and their practices.

I usually take a slightly different approach. I choose to benchmark my audit activities with the Institute of Internal Auditors (IIA) proposed Internal Audit Maturity Assessment Model.


What is IIA Internal Audit Maturity Model?

The maturity model helps in positioning the future state of the internal audit department. The IIA Internal Audit Maturity Assessment Model is a self-assessment tool that provides levels of ambition and concrete best practices that can serve as guidelines for the Head of Internal Audit to formulate strategic objectives, evaluate the current internal audit function and define a road map to achieve the stated objectives. 


Rating on a Scale of 1 to 5

The IIA Internal Audit Maturity Model encompasses five levels. Each level describes the characteristics and capabilities of the internal audit activity. The five levels of the internal audit maturity model are initial, define, implement, managed and optimized.

  1. Initial – Internal audit is ad hoc or unstructured, few processes are defined, and practices are performed inconsistently.
  2. Define – Internal audit basic practices and procedures are performed on a regular and repeated basis.
  3. Implement – Internal audit policies and procedures are defined, documented and integrated into each other.
  4. Managed – Internal audit becomes an integral part of the organization’s governance and risk management practice.
  5. Optimized – Internal audit focuses on learning for continuous improvement to enhance the capability.


Criteria to Rate Each Activity

The detailed level assessment, pertaining to IIA’s standards requirement with an example (current state case of IA Department), is given below:


Based on the above assessment, you can easily draw a table (fig.1) depicting the status of each standard (IPPF) requirement against the current practice in the IA Department between 1 to 5. In the end, you can simply sum up the total scores and divide the total by 60 (12 standards X 5 levels) and then by multiplying with 5 (scale of 5) to obtain overall rate. Based on the above assessment, the overall rate of the department process maturity on a scale of 1 to 5 lies at 1.75

Fig.1 – Internal Audit Process Maturity (Current State)

In the above case study, the IA Department maturity falls at a level 2 (Define) means the IA Department has basic practices and procedures that are performed on a regular and repeated basis.

The average rating for any internal audit department should be at least 3 (Implement) on the scale of 1 to 5. 



The Internal Audit Maturity Model shows the steps in progressing from a level of internal auditing typical of a less established organization to the strong, effective, internal audit capabilities generally associated with a more mature and complex organization.

Reference Material: Benchmarking Internal Audit MaturityInternal Audit Ambition Model

Arif Zaman