You are part of the Internal Auditing team in a company. How would you set the KPIs to measure compliance and risk appetite?

Audit KPIs

1. Number of Business functions audited (Achieved/Targeted) as per audit calendar

2. For the audited functions, # compliance breaches

3. For each business function, severity distribution of compliance breach (High, Medium, Low)

4. % compliance breaches which have crossed the due date for fixing for each business function and splitted into High, Medium, Low severity categories

5. Split point 4 again as per ageing (<= 30 days, 30 to 60 days, >60 days)

Risk Appetite:

At Business Function Level - 

1. Weighted average severity index of complinace breaches. 

2. % breaches in the High severity category

3. Expected monetary loss from the due High Severity compliances as a % of internal budget of the business function

At Organization Level - repeat the above at organization level