Performance Playbooks › Finance › Audit & Internal Controls
The audit function that closes gaps and keeps them closed
Learn how top audit teams break the cycle of recurring findings and build controls that work continuously. Discover the structural shifts—not just effort—that move remediation cycles from months to weeks.
World-class audit functions complete 95–99% of their planned audits, close control deficiencies in 30–60 days, and monitor 55–75% of critical controls continuously rather than through annual testing. The gap from strong to world-class is not more audit hours—it's embedding controls into processes so they fail less often, automating the testing that proves controls work, and aligning remediation accountability to a single owner with authority to move fast across functions.
Where the best performers sit
| Metric | Minimum | Strong | World-class |
|---|---|---|---|
| Internal Audit Plan Completion RatePercentage of planned internal audit activities executed within the fiscal year relative to the approved audit plan. | 75-85% | 85-95% | 95-99% |
| Control Deficiency Remediation Cycle TimeAverage number of days from identification of a control deficiency to implementation and validation of the remediation. | 90-120 days | 60-90 days | 30-60 days |
| Audit Finding Recurrence RatePercentage of control deficiencies or audit findings from prior periods that reoccur in subsequent audit cycles. | 15-25% | 8-15% | 2-8% |
| Continuous Control Monitoring CoveragePercentage of high-risk or critical financial and operational controls that are monitored on a continuous or automated basis rather than periodic manual testing. | 20-35% | 35-55% | 55-75% |
| Audit Independence and Resource Adequacy ScoreComposite assessment of internal audit function's reporting independence, budget allocation as a percentage of revenues, and staffing levels relative to organizational complexity and risk profile. | 1.5-2.5 | 2.5-3.5 | 3.5-4.5 |
| Control Testing Efficiency RatioNumber of control tests executed per internal audit full-time equivalent resource per fiscal year. | 40-60 tests | 60-85 tests | 85-120 tests |
The spread between strong and world-class reveals where time and effort leak. Strong organizations complete 85–95% of audit plans; world-class reaches 95–99%—a small gap that usually means strong teams face competing regulatory demands or staffing volatility, while world-class teams have stabilized resourcing and can protect audit calendar commitments. Remediation cycle time widens the most: strong teams average 60–90 days, world-class 30–60 days. That 30-day swing compounds across dozens of findings per year—the difference between resolving root causes and closing tickets. Recurrence rates tell the story: strong performers repeat 8–15% of prior findings; world-class organizations repeat only 2–8%, meaning their root-cause analysis and control redesign actually stick. The most revealing gap is continuous monitoring coverage: strong teams monitor 35–55% of critical controls; world-class teams monitor 55–75%. That difference means world-class teams detect control failures in days, not weeks, and rarely face surprise findings during audit cycles. Organizations in the strong tier often ask why remediation takes so long; the answer usually lies in not monitoring continuously—they discover problems during audits, then have to investigate, design, test, and validate fixes sequentially.
What drives the difference
The jump from strong to world-class stalls on three structural obstacles. First, remediation authority is diffused: control deficiencies require changes across systems, finance workflows, and business unit behavior, yet no single leader owns the remediation timeline. Strong organizations assign remediation to the business process owner, but that owner rarely has budget or IT capacity to implement controls immediately—they queue behind operational initiatives. World-class organizations embed remediation commitments into quarterly business reviews with CFO attendance, assign a dedicated remediation coordinator, and reserve IT capacity monthly for control fixes. Second, most organizations test controls on a batch cycle—quarterly or annual—meaning control failures go undetected between test dates. Strong performers invest in spot-checking between cycles; world-class teams instrument their core transaction systems to log control execution continuously and flag exceptions in real time. This shift from detective to preventive monitoring catches control deterioration before audit, cutting investigation and remediation time by weeks. Third, control design is often generic: organizations document that a "manager reviews and approves expense reports," but don't define what approval means, what thresholds trigger exception handling, or how to detect when the control is bypassed. World-class audit functions work with process owners to specify control design precisely—exactly which transactions bypass approval, what triggers the bypass (emergency flag, system workflow rule), and how monitoring proves the bypass is rare and justified. This precision reduces recurrence because remediation addresses the real control gap, not a vague policy.
Metric by metric
Internal Audit Plan Completion Rate
The single lever here is stabilizing audit resourcing and protecting the audit calendar from mid-year disruption. Strong teams complete 85–95% of planned audits; the difference between strong and world-class (95–99%) almost always comes down to staffing continuity and the ability to say no to unplanned regulatory or crisis requests that hijack the audit team. World-class organizations maintain a staffing buffer (typically one extra full-time equivalent per ten planned audits) and require that unplanned audit requests be approved by the audit committee, not just by management. You know this is working when your audit plan completion rate stabilizes above 95% and unplanned audits represent less than 5% of total hours, meaning the team executes its strategy rather than reacting.
Get the full Internal Audit Plan Completion Rate playbook →Control Deficiency Remediation Cycle Time
The most powerful lever is assigning single-threaded remediation ownership with explicit deadlines tied to executive accountability. Strong teams average 60–90 days from finding to validation; world-class teams compress this to 30–60 days by having finance leadership own remediation timelines, reserving IT capacity monthly for control implementation, and validating fixes within two weeks of implementation rather than waiting for the next audit cycle. The core mechanism: instead of sending findings to business process owners and hoping, world-class audit functions schedule monthly remediation reviews where the business owner, IT lead, and CFO review open findings, assign implementation sprints (two to four weeks), and confirm completion dates. You know this is working when remediation backlog turns over monthly and investigation time for each finding drops from weeks to days.
Get the full Control Deficiency Remediation Cycle Time playbook →Audit Finding Recurrence Rate
Recurrence drops dramatically when root-cause analysis moves from blaming the process to fixing the control design itself. Strong performers see 8–15% of findings repeat; world-class organizations achieve 2–8% recurrence by insisting that remediation include a root-cause hypothesis ("this approval was bypassed because the system workflow allowed it" rather than "staff didn't follow the policy") and a control redesign that makes recurrence much harder (system workflow rule, segregation of duties, automated exception routing). The other half of this lever is continuous monitoring: if you monitor the remediated control after implementation and flag any degradation, you catch recurrence within weeks rather than at next year's audit. You know this is working when remediation addresses control design, not just behavior, and when the majority of remediated controls pass validation on first test.
Get the full Audit Finding Recurrence Rate playbook →Continuous Control Monitoring Coverage
The lever is treating continuous monitoring as a multiyear investment program with quarterly expansion targets, not a one-time project. Strong teams monitor 35–55% of critical controls continuously; world-class organizations reach 55–75% by selecting five to ten high-impact controls each quarter, building automated testing logic (data queries, exception detection), and integrating results into a central dashboard. Start with controls that are high-risk but rule-based and automatable: access controls, segregation of duties, transaction limit overrides, reconciliation completeness. World-class organizations measure success by tracking the percentage of control exceptions that are detected through automated monitoring before the next audit cycle, targeting high detection rates. You know expansion is working when your monitoring team shrinks relative to test volume, meaning automation is increasing.
Get the full Continuous Control Monitoring Coverage playbook →Audit Independence and Resource Adequacy
This metric rises when the audit committee treats audit as a strategic investment, not a cost center, and protects its independence through direct reporting, private sessions, and authority to access any area of the organization. World-class audit functions report directly to the audit committee (not the CFO), have a dedicated budget allocation tied to organizational complexity and risk, and maintain staffing ratios that allow specialization (IT audit, compliance audit, operational audit). The board-level mechanism that matters most is the audit committee charter that explicitly permits internal audit to investigate concerns raised by employees or regulators without management approval. You know independence is credible when external auditors rely on your testing to reduce their own scope, when business unit leaders report findings to you rather than their bosses first, and when your annual budget grows as organizational complexity grows.
Get the full Audit Independence and Resource Adequacy Score playbook →Control Testing Efficiency Ratio
Efficiency jumps when audit teams automate routine testing and standardize procedures across audits. Strong teams execute 60–85 control tests per full-time equivalent annually; world-class teams achieve 85–120 tests by building reusable audit procedures, using data analytics to test samples automatically instead of manually, and creating standardized workpapers and evidence templates. The key lever is moving from transaction-level testing (examining a sample of expense reports by hand) to population-level testing (running a query against all reports to find exceptions). Organizations typically see significant efficiency gains in the first year of data analytics deployment, because the same auditor now covers far more transactions. You know this is working when your time per test falls consistently and when auditors spend more time on judgment-based activities (design assessment, remediation planning) than on routine evidence collection.
Get the full Control Testing Efficiency Ratio playbook →Proven approaches
Risk Control Mapping and Effectiveness Assessment
This practice creates a systematic inventory of which controls address which risks and how well they actually work in practice. Start by listing your organization's top 20–30 financial and operational risks, then map the specific preventive and detective controls that address each one—often you'll find that some risks are over-controlled (multiple redundant controls) while others have gaps. Next, assess each control's design (is it logically sound?) and operating effectiveness (did it work this year?) separately, because a well-designed control can fail in practice if no one is monitoring it. The output is a control register with clear ownership, testing frequency, and remediation priorities based on risk exposure. Organizations that complete this practice typically find that 15–25% of controls are redundant or ineffective, and closing those gaps reduces both audit findings and ongoing compliance effort. Use this as the foundation for your remediation planning and monitoring roadmap.
Leading Practice Report
Full detail: Risk Control Mapping and Effectiveness Assessment
The full report covers:
- Expected benefits
- Core principles
- Key success factors
- Key metrics
- Risks and mitigations
- Implementation roadmap
Control Performance Analytics and Continuous Monitoring
This practice shifts from testing controls periodically to monitoring them continuously through data analytics and automated exception detection. Rather than waiting for an annual audit to test whether segregation of duties is working, you build a monthly automated query that runs against your transaction system and flags any transactions that violate your segregation rules—then investigate exceptions immediately instead of months later. Start with one high-risk control area (revenue recognition, access controls, financial statement close procedures) and build the data logic, alert mechanism, and remediation workflow for that area. Once you prove the model works, expand to five or ten more controls quarterly. The typical timeline from starting continuous monitoring to detecting most control failures before audit spans several months of sustained implementation. Finance and IT collaboration is essential here; ensure your IT team understands what constitutes a control failure (not just a technical configuration) so the monitoring logic is precise.
Leading Practice Report
Full detail: Control Performance Analytics and Continuous Monitoring
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →Audit Committee Governance and Internal Audit Oversight
This practice establishes the audit committee as an independent body with explicit authority over internal audit and direct oversight of the control environment. The foundation is a written audit committee charter that clarifies the committee's authority to appoint and remove the chief audit executive, approve the annual audit plan, review all significant findings, and mandate corrective action—all independent of management approval. Implement quarterly private sessions where the audit committee meets with internal audit leadership alone, without CFO or CFO staff present, so audit can speak freely about control gaps, management resistance to remediation, or fraud concerns. Build a monthly reporting dashboard that tracks audit plan progress, open findings, remediation status, and control monitoring results—this becomes the audit committee's scorecard for organizational control health. The board's commitment to this practice is tested when a significant finding emerges: if the audit committee can mandate remediation independent of management objection, and can escalate concerns to the board, independence is real.
Leading Practice Report
Full detail: Audit Committee Governance & Internal Audit Oversight
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →Where to begin
- Audit plan completion: Block two hours with your chief audit executive and map the prior three years of planned versus completed audits by quarter. Identify which audits were deferred, why, and whether those reasons (regulatory requests, staffing gaps, calendar conflicts) are recurring or one-time. If completion is below the strong performance threshold, calculate the cost of the gap—both in audit hours burned on unplanned work and in audit cycles missed—and present this to the audit committee with a proposal to stabilize staffing or protect calendar time.
- Remediation cycle time: Pull your open audit findings from the past 12 months and calculate the average days from identification to implementation sign-off. Group findings by type (design deficiency, operating failure, compensating control needed) and by business function. If your average exceeds 90 days, interview three process owners about their top open findings and ask exactly what is preventing them from implementing the fix: is it budget, IT capacity, priority, or unclear ownership? The answer usually reveals the structural bottleneck you need to address.
- Continuous monitoring: Identify your five highest-risk controls—those that, if they failed, would create material financial statement risk or regulatory exposure. For each one, write down: (1) what the control is supposed to prevent, (2) how you currently test it (monthly, quarterly, annually, never), and (3) what data you would need to automate detection of failures. Then meet with your IT and finance data analytics teams to estimate the effort to build automated testing for just one of these controls as a pilot. Start there.
What is your current control deficiency remediation cycle time, and what is blocking you from moving it into the 30–60 day range?
Start free with Ask Kepler →Advanced and emerging approaches
Advanced & Emerging Practices
Emerging practices are included with Ask Kepler Pro and Max.
Unlock these practices →How are these playbooks made? Read our methodology.