How to define multi-location Audit KPIs

Start with the decision a KPI must support

Multi-location Audit KPIs show whether a programme runs on time, which Findings await resolution, where Action ownership accumulates and whether corrections last. Yet the same number can mean something different when scope or time definitions change.

Write a one-sentence decision question before defining a KPI. Replace “show Audit count” with “what share of Audits due in this period finished inside their time window?” Replace “Action performance” with “which Locations and responsibility areas hold overdue open Actions?”

A KPI is not a box on a report. It is a definition made of a decision question, formula, scope, time period, data owner and interpretation boundary.

A ratio is not comparable when its denominator changes

When one region has 20 Audits and another has 200, comparing only completed counts hides workload. A rate can reduce that problem, but it is still misleading when each report uses a different denominator.

For example, the denominator for on-time completion must be one defined set:

• Audits due during the reporting period
• Audits started during the reporting period
• Audits completed during the reporting period
• All Audits generated by the programme

These sets are not interchangeable. Adding records due next month to today’s denominator artificially lowers the rate. Silently removing occurrences that could not be assigned hides a programme-capacity problem.

Document included and excluded states for every KPI. When a formula changes, do not present it as the same historical series. Record the definition change with its effective date and reason.

Programme execution KPIs

Programme indicators show whether planned Audits were created and completed under the intended scope and timing.

On-time completion rate

Formula: Audits completed inside their time window / Audits due during the reporting period × 100

The rate describes programme discipline. It should classify late completions separately and exclude records that are not yet due. Audits that never started because assignment failed should remain visible through a companion indicator; otherwise a Role or capacity problem disappears.

Unstartable occurrence rate

Formula: Occurrences not started because of assignment or scope / occurrences expected × 100

This indicator tests access, Role and Location configuration more than field-team performance. A high value should not automatically be interpreted as poor auditor performance.

Mean and median completion time

Formula: Time between Audit start and completion

The mean can be distorted by a few very long Audits. Showing the median and, where possible, the distribution supports safer interpretation. Before comparing sectors, consider Question count, Evidence requirements, Location size and offline working conditions.

Finding KPIs

Finding indicators help management understand the observations and risk records behind a score.

Open Finding density

Formula: Open Findings / completed Audits, or open Findings / audited Locations

The right denominator depends on the decision question. Density per Audit helps compare visit and Template scope. Density per Location helps describe the network’s resolution load. Raw density is not comparable when Templates differ materially in Question count or severity rules.

Severity distribution

Formula: Open Findings at a severity level / open Findings × 100

One total can hide a small number of high-severity records. Break the distribution down by Location, Section and Template Version. When severity definitions change, do not merge old and new Versions into one unexplained series.

Recurring Finding rate

Formula: Relevant Findings observed again in a later Audit / previous Findings followed × 100

Do not identify recurrence through similar text alone. Use the persistent Question, Location and Template-family context through the Finding Chain and Follow-up Result. When parallel Audits produce inconsistent results, resolve the Follow-up Conflict instead of letting the last writer win.

Action and Verification KPIs

When Action Management is enabled in the Internal Audit product, responsibility after a Finding can be measured separately. The External Audit product does not use Action Management; follow-up should be measured through later Audits and Follow-up Results.

Overdue Action rate

Formula: Non-terminal Actions past due / non-terminal Actions × 100

Adding Closed or Verified Actions to the denominator can make the current queue appear healthier than it is. The Organisation time zone and end-of-day due-date rule must match the report. Break the rate down by severity and responsible Role to show impact and ownership.

First-submission Verification rate

Formula: Actions Verified on their first resolution submission / Actions submitted for Verification for the first time × 100

A high rate does not always indicate a better process; weak Verification criteria can produce easy acceptance. A low rate may reflect insufficient Evidence, an ambiguous Action description or a genuine implementation problem. Review rejection reasons qualitatively as well.

Verification cycle time

Formula: Time between Action assignment and the first valid Verification decision

Split the total into useful parts: time until the owner’s first submission, time waiting in the Verification queue and rework after rejection. One total cannot show which Role holds the delay.

Rework rate

Formula: Actions rejected at least once / Actions submitted for Verification × 100

This rate tests clarity of resolution Evidence and the Action definition. It should not be used alone to rank people. The number of repeated rejections on one Action can be reviewed as a separate distribution.

Do not rank Locations through one score

A Location league table looks easy to read but creates false precision when it compresses different scopes into one score. One Location may face more Questions, more critical controls or a higher Audit frequency. A new Location and a mature site may also have different data periods.

A management view should provide at least this context:

• Template and Version used
• Audit type and programme
• Reporting period and number of records due
• Severity distribution
• Open and overdue Action load
• Data-sufficiency or missing-period warning

The goal is not to manufacture winners and losers. It is to identify which Location needs which support or management decision.

Build a KPI dictionary

Record these fields for every indicator:

Field	Description
Name and decision question	What the KPI answers
Formula	Numerator, denominator and time calculation
Included states	Which records belong in the calculation
Excluded states	Treatment of cancellation, future periods or missing data
Dimensions	Location, Section, severity, Role and Template Version
Data owner	Who owns the definition and quality?
Refresh rhythm	Daily, weekly or period-based update
Interpretation boundary	What the number cannot say alone

Complete this dictionary before designing the dashboard. It prevents two charts with the same name from using different denominators.

Illustrative calculation

The following numbers are illustrative data for explaining the formula, not customer results.

Suppose 24 Audits appear in a monthly programme. Eighteen finish inside their window, three finish late, two never start because of assignment problems and one is not due yet. The future record is excluded. Under the stated definition, 23 Audits were due and the on-time completion rate is 18 / 23.

Excluding the two unstartable records and calculating 18 / 21 might describe field execution, but it hides programme configuration. Publish the unstartable occurrence count beside the primary rate and state the choice in the KPI dictionary.

Likewise, if four of 12 open Actions are past due, the overdue Action rate is 4 / 12. Adding 40 historically closed Actions to the denominator would make the current queue look healthier and should be avoided.

Organise dashboards around decision rhythm

A daily operations view can prioritize overdue high-severity Actions and the Verification queue. A weekly programme view can cover Audits due, unstartable occurrences and capacity. A monthly management view can examine recurrence, severity distribution and patterns across Locations.

Narrow each view to its audience’s area of action:

1. Field Role: Audits that must start or finish today
2. Action owner: Upcoming and overdue due dates
3. Verifying Role: Resolution submissions awaiting review
4. Programme owner: Scope, capacity and on-time completion
5. Management: Severity, recurrence and systemic bottlenecks

Users should be able to move from an indicator to its related Audit, Finding or Action records. Totals that cannot be explained do not build trust.

How to introduce the first KPI set

1. Select three to five decision questions.
2. Document the numerator, denominator, time zone and state dictionary for each.
3. Use the first period to check data quality before setting a target.
4. Mark missing assignment, synchronisation or Version differences separately.
5. Review whether the numbers represent the real process with Location managers.
6. Publish a changed KPI definition as a new Version.
7. Set targets only after data scope and behavioural effects are understood.

Use the Field Audit Management Guide for the programme foundation, multi-location Audit Schedule guide for planning detail and CAPA, correction and Action differences for corrective-process boundaries.