Information drives modern organizations, so it is imperative that metrics be used that give management objective information about the progress made towards the achievement of organizational goals and objectives, and the effectiveness of related internal controls. Having quantitative and qualitative data goes a long way towards providing proper oversight and timely correction notices to those responsible for taking corrective action.

Key Performance Indicators (KPIs) are measurable values that show how effectively an organization is achieving key objectives. They are metrics that evaluate the success of an organization, program, or process, and provide a scorecard showing how well the strategy and the related goals are being achieved. Examples include sales, number of employees, number of product shipments, production figures, number of interviews, and sales calls. With this information, management and employees can gauge their efforts towards various goals.

Key Risk Indicators (KRIs) are also metrics and constitute a subset of KPIs. For example, while selling matters a great deal to organizations, getting paid on the amount of those sales is critical.  Any organization that fails to collect on its Accounts Receivable (AR) will face serious financial hardship. So, while sales are very good KPIs, AR delinquent balances and AR write-offs are essential KRIs to determine how successful those sales, and the related collection, really was.

Similarly, the number of product shipments is a very good KPI, but what if those shipments are incomplete, made to incorrect addresses, or are shipped late and miss the due-date agreed upon with the client? So, shipment accuracy, completeness, and timeliness are necessary KRIs to obtain better visibility into the effectiveness of that process.

KPIs and KRIs require data to be collected, evaluated, assessed and shared. So poor data quality is a problem that needs to be examined and addressed. Likewise, narrowly collecting and analyzing the data, without sharing the information with others who can take corrective action or otherwise benefit from the information needs to be addressed.

How Many KPIs and KRIs Does an Organization Need?

Organizations don’t need many KPIs or KRIs. As the name suggests, only the key ones are required. Therefore, the organization should carefully select, report, and manage those chosen.  The selection of KPIs begins with the business objectives and focus not only on what the goals are but on the steps taken to achieve them.  A dashboard is often used and can be treated like the one on automobiles, where it is used to monitor the major activities and functions at a glance using the instrument panel. 

How Should KPIs and KRIs be Presented?

The presentation of the data is also very important. Long text with embedded figures is not the most effective way of handling KPIs and KRIs. Tables are better, but key figures could be hidden and escape scrutiny when they are embedded in large tables. So increasingly organizations develop dashboards that provide progress reports using visual tools to present the information. Dashboards are often displayed on a webpage that is linked to a database, so the reports can be updated constantly. In a manufacturing organization, a dashboard will focus on productivity metrics, like the number of parts made and the number of errors or failed quality inspections per day. In a human resources unit, a dashboard may show the number of full and part-time employees, number of open positions, number of interviews conducted, cost per recruit and turnover figures.  

Line Charts, Pie Charts, and Bar Charts are typically used, especially when they are accompanied by color and other visual cues that highlight anomalies and show patterns and proximity to concerning boundaries. This snapshot view using visual presentation of data allows the organization to:

    • Measure efficiencies and inefficiencies
    • Identify and correct negative trends
    • Align strategies and organizational goals
    • Save time compared to running multiple reports
    • View all major programs, processes and units immediately

How Do We Develop Them?

The construction of KPIs should always begin with a clear understanding of the desired business goals, outcomes, and results. However, simply stating the goal and measuring sales (the “what”), for example, may yield limited results. Instead, appropriate metrics may include details about progress (the “how”). For example, sales cycle, lead generation and repeat business. 

These metrics can then be supplemented with boundaries, so limits can be placed to indicate thresholds.  In that case:

  • Sales cycle could be measured against a goal to reduce the sales cycle by 50 percent to sell faster.
  • Lead generation may have a goal of generating 50 percent more leads by growing the pool of potential buyers
  • Repeat business could have a goal of having existing customers buy 25 percent or more.

So you build the KPIs and KRIs to know what you want to accomplish and monitor the key steps to get you there.

Where Do We Get The Data?

Wishing the data is not enough.  We need to get it, so the next step is to find the source of the data and determine how frequently to generate these figures. In some cases, the dashboard can be updated daily or weekly. Some organizations with ready access to real-time data can generate dashboards at any time. Others with more manual processes may have two, three or four-week cycles. The challenge is that the longer the interval between updates, the likelihood of deviation, and their magnitude increases because by the time the report is produced some of the KPIs/KRIs could have drifted substantially.

When setting the goals to measure progress, it’s important to make sure these are realistic.  Otherwise, the goals are potentially unachievable, or those providing the information may falsify the information in their efforts to conceal their failure.

Developing Comparison Points

Finally, a comparison point is helpful to assess progress on each KPI/KRI.  This can be the previous year, quarter, week or month. Having owners for each KPI/KRI is also helpful so if deviations from expected results emerge, accountabilities are established, and it is clear who should be contacted to research, explain and resolve these deviations.

By collecting sufficient, useable, reliable and timely data, and developing KPIs and KRIs, internal auditors can gain a better understanding of business performance, the underlying risks, and any deviations from the achievement of business objectives.