Building an Internal Audit Scorecard for Compliance and Risk-Appetite Tracking

You work on the internal audit team of a company. How would you set key performance indicators that show how well the company complies with its obligations, and whether it is operating within the level of risk it has said it is willing to accept (its risk appetite)? ```hint Two questions, two reference points Compliance asks whether rules and controls are being followed; risk appetite asks how much exposure the company carries compared with what it agreed to accept. Decide what each kind of indicator should be measured against, and why a raw count of issues can mislead. ``` ### Clarifying Questions - What kind of company is this, and is it regulated (for example a bank or payments firm), so that external rules define many of the compliance obligations? - Has the board approved a risk appetite statement with measurable limits per risk category, or would audit have to work with the risk function to make it measurable? - Should the KPIs judge the audit team's own performance, the business's compliance and risk position, or both? - Who will read them and how often: the audit committee each quarter, business heads each month, or both? ### What a Strong Answer Covers - A clear split between compliance indicators (control effectiveness, breaches, remediation) and risk-appetite indicators measured against approved limits. - Severity weighting, ageing and trends by business unit instead of raw issue counts. - Indicators of audit coverage, so readers know how much of the business the numbers actually describe. - Thresholds that trigger escalation, a named owner for each indicator and a reporting cadence. - Incentive and data-quality risks, such as units under-reporting issues once a KPI is tied to their performance. ### Follow-up Questions - After a business head's bonus is linked to the number of open findings, that unit's count halves in one quarter. How do you tell real improvement from under-reporting? - How would you measure appetite for a risk that is hard to express in money, such as conduct or reputational risk? - The executive team asks for one company-wide score. What would you give them, and what would you warn them about?