Audit Plan Completion Rate

Goal of the analysis:

The audit plan completion rate measures the percentage of planned audits executed within the defined cycle (e.g., annual plan), and how reliably the Internal Audit (IA) function delivers on its commitments to the Audit Committee and executive management. It is a leading indicator of execution discipline, risk coverage, and the credibility of the IA function. Executives use it to assess whether high-risk areas are being audited on time, whether resources are appropriately planned, and whether plan changes (deferrals, cancellations, substitutions) are risk-based and well governed. Properly analyzed, this metric highlights both assurance coverage and operational effectiveness without sacrificing quality.

Data required:

• Plan and engagement metadata:
  • Approved annual/rolling plan with engagement IDs, titles, audit type (operational, compliance, financial, IT/cyber), entity/process, region, and risk tier (high/moderate/low).
  • Planned start/end dates, planned hours/budget, audit owner/lead, and due dates for reporting to the Audit Committee.
• Execution status and timing:
  • Current status per engagement: not started, planning, fieldwork, reporting, issued, deferred, canceled.
  • Actual start date, actual report issue date, milestone dates, scope changes, and reasons for delays.
  • Actual hours vs planned; rework/QA review outcomes (if available).
• Risk and prioritization data:
  • Enterprise risk assessment outputs mapping engagements to key risks.
  • Risk tier and any regulatory/board-mandated audits.
  • Emergent events requiring off-plan audits (e.g., incidents, regulatory requests).
• Change control and exceptions:
  • Plan change log capturing deferrals, cancellations, and additions with dates, rationale, and approval authority.
  • Classification of reasons (e.g., business unavailability, staffing constraints, M&A, reprioritization due to new risks).
• Resource and capacity data:
  • Staffing roster, FTE availability, PTO/leave, turnover, co-sourcing usage, and skill mix.
  • Competing priorities (e.g., investigations, special projects) drawing capacity from planned audits.
• Historical and benchmark data:
  • Prior year plan and results, quarterly cadence, and trend of on-time completion.
  • Internal targets and external indicative ranges for completion, deferral, and on-time rates.

Detailed step-by-step instruction on how to conduct the analysis:

1. Define scope and measures. Set the time horizon (e.g., FY), the definition of “completed” (e.g., report issued), and “on-time” (e.g., issued by committed date). Decide whether to show both baseline metrics (against original plan) and adjusted metrics (after approved plan changes).
2. Extract the plan. From your GRC/Audit tool (e.g., TeamMate+, AuditBoard, Diligent/HighBond, Archer, ServiceNow GRC), export the approved plan with engagement metadata, planned dates, risk tier, and budgeted hours.
3. Pull execution actuals. Export engagement status, milestone dates, actual hours, issue date, and QA results from the same system. If needed, reconcile with PM/timekeeping tools and workpapers.
4. Compile the change log. Extract all plan changes during the period: deferrals, cancellations, and additions. Include the date, approval (e.g., CAE/Audit Committee), and rationale. Normalize reasons into a standard taxonomy.
5. Standardize statuses and cleanse data. Map inconsistent status labels, remove duplicates, and confirm each engagement has a unique ID. Resolve gaps (e.g., missing issue dates) with audit managers. Align the “completed” date to report issuance.
6. Calculate core metrics.
   • Baseline Completion Rate = Completed_original / Planned_original
   • Adjusted Completion Rate = Completed_adjusted / Planned_adjusted, where Planned_adjusted = Planned_original − Canceled_approved + Added_approved. Clarify whether like-for-like substitutions count as fulfilled high-risk coverage.
   • On-time Completion Rate = Completed_on_or_before_due / Completed_total
   • Deferral Rate = Deferred / Planned_original; Cancellation Rate = Canceled / Planned_original; Substitution Rate = Added_approved / Planned_original
   • Schedule Variance (days) = Actual_issue_date − Planned_issue_date; Cycle Time = Actual_issue_date − Actual_start_date
   • Risk Coverage = Completed_high_risk / Planned_high_risk
   • Capacity Variance = Actual_hours − Planned_hours (by engagement and in aggregate)
7. Segment the results. View metrics by risk tier, audit type, business unit, region, quarter, audit lead, and regulatory-mandated vs discretionary audits. Flag high-risk audits that are deferred or late.
8. Trend and cadence analysis. Plot quarterly/monthly completion and on-time rates versus plan run-rate to identify late-year compression risk. Compare against prior years to assess improvement or deterioration.
9. Drivers and root causes. Use Pareto charts of deferral/cancellation reasons. Correlate delays with capacity gaps, business readiness, scope creep, or QA rework. Identify systematic bottlenecks (e.g., data access) and high-variance teams.
10. Risk-adjusted interpretation. Separate metrics for high-risk audits. Present how approved substitutions changed risk coverage (e.g., dropped a low-risk audit to add an emergent high-risk one). Provide both baseline and adjusted views to maintain transparency.
11. Quality checks. Reconcile totals with Audit Committee reports. Confirm that “complete” status aligns to issued reports and not merely fieldwork complete. Validate major variances with engagement owners.
12. Summarize insights and actions. Draft a concise narrative of performance, risks to plan, and improvement levers (planning discipline, resource augmentation, stakeholder engagement, agile ways of working).

Format of the output of analysis:

• Executive dashboard with KPIs: baseline vs adjusted completion, on-time rate, deferral/cancellation/substitution rates, and risk coverage.
• Burndown chart of planned vs completed engagements across the year; quarterly run-rate view.
• Waterfall showing movement from original plan to adjusted plan (cancellations, additions) and completed vs open.
• Heatmap of risk coverage by business unit and risk tier, highlighting overdue/deferred high-risk audits.
• Pareto of plan change reasons and a table of top delayed engagements with root-cause notes.
• Gantt/milestone views for high-risk audits and a capacity vs demand chart (planned vs actual hours).
• Appendix tables: segmented metrics by audit type, region, and lead auditor; prior-year comparison.

How to interpret results:

• High completion with strong on-time rate: Indicates disciplined execution and credible planning. Validate that quality (QA results) and risk coverage remain high; watch for scope shrinkage masking issues.
• Low completion or heavy late-year compression: Signals overambitious planning, capacity constraints, business readiness issues, or scope creep. Increased late issuance may weaken impact and management buy-in.
• High deferral/cancellation rates: Acceptable if tied to risk-based reprioritization or emergent events and accompanied by stronger high-risk coverage. Problematic if driven by recurring access/data issues or staffing gaps.
• Risk coverage gaps: Low completion for high-risk audits is a red flag even if overall completion is high. Prioritize these and escalate to the Audit Committee.
• Segment differences: Consistently lower on-time rates in IT/cyber or specific regions may indicate skill shortages, scoping issues, or vendor dependencies needing targeted intervention.
• Trend view: Improving quarter-over-quarter trajectory suggests maturing execution; volatility implies weak planning or governance. Benchmark comparisons should calibrate ambitions but not trump risk-based decisions.

Steps a company can take to improve on this measure:

• Planning and governance:
  • Adopt a rolling plan with quarterly refreshes; set explicit high/medium/low risk coverage targets (e.g., ≥90% of high-risk audits in-year).
  • Institute formal change control for deferrals/substitutions with CAE/Audit Committee oversight and standardized reason codes.
  • Right-size scope at intake using scoping templates and hypothesis-led planning to avoid mid-stream scope creep.
• Execution discipline (ways of working):
  • Use agile internal audit practices: timeboxed sprints, interim readouts, and early evidence requests to de-risk delays.
  • Set milestone SLAs with the business (PBC turnaround times) and monitor in a shared tracker with RAG status.
  • Front-load complex data access work and secure system permissions before fieldwork starts.
• Resourcing and capability:
  • Deploy capacity planning and skills mapping; co-source to cover peaks or niche areas (e.g., cybersecurity, models).
  • Create a rapid response pool for investigations/emergent audits to protect the core plan.
  • Train audit managers in project management and stakeholder management; coach teams on concise, early issue escalation.
• Data, systems, and tooling:
  • Integrate GRC with timekeeping and project tools for real-time status; automate dashboards and burndown charts.
  • Use PBC portals and automated reminders; apply analytics to identify bottlenecks (e.g., aging items, overdue milestones).
  • Standardize workpaper templates and QA checklists to reduce rework and last-mile delays.
• Stakeholder alignment and incentives:
  • Agree audit windows with business leaders during planning; lock key dependencies (data owners, SMEs).
  • Balance incentives: track completion and on-time alongside quality metrics (e.g., issue clarity, management action plan acceptance) to avoid gaming.
  • If overall completion is high but high-risk coverage is low, reallocate capacity and re-baseline plan mid-year with Board visibility.

Benchmark comparisons:

General benchmarks:

• Many mature IA functions target annual plan completion in the 80–95% range; on-time completion often targets 70–90% depending on complexity and regulatory demands.
• Deferral/cancellation rates commonly fall in the 5–20% range, with higher variability in dynamic industries or during transformation years.
• There are no universal standards mandating a specific rate; completion should be balanced with risk-based agility and quality.

Segment- or industry-specific benchmarks:

• High-risk audits: Aim for ≥90% in-year completion; escalate any deferrals to the Audit Committee with compensating actions.
• IT/Cyber and model risk: Often exhibit lower on-time rates due to data and SME constraints; 65–80% on-time can be typical without targeted resourcing.
• Regulated industries (financial services, healthcare, utilities): Tend to operate at the higher end of completion due to mandated coverage and fixed regulatory calendars.
• Compliance audits: Generally higher predictability and completion versus complex operational or transformation audits.

Constructing internal benchmarks when external data is limited:

• Use a three-year rolling view to set realistic targets; compare by audit type, region, and risk tier.
• Create internal quartiles across audit teams/leads and set improvement targets for the bottom quartile.
• Establish separate targets for baseline vs adjusted completion to encourage transparent change control and risk-based substitutions.