07 June 2017

Performance management
Chartered Institute of Internal Auditors

Performance management is something that is familiar to all of us. It involves setting objectives
and/or standards and then measuring performance to ensure our goals are being achieved.

This guide will help you plan an internal audit of your organisation's performance management
procedures.

What is performance management

The performance management framework
Why is performance management important?
How can organisations approach it?
Potential risks and responses
What factors you should consider
What can internal audit do?

What is performance management?

In her guide to human resources Susan M. Heathfield states:

'Performance management is the process of creating a work environment or setting in which people
are enabled to perform to the best of their abilities. Performance management is a whole work
system that begins when a job is defined as needed. It ends when an employee leaves your
organization.'

The business dictionary states that performance management is:

'An assessment of an employee, process, equipment or other factor to gauge progress toward
predetermined goals.'

Both of these definitions suggest that continuously improving the performance of individuals will
improve the performance of the organisation. The starting point for performance management is
therefore the strategic aims, objectives and goals that filter down the organisation to departmental,
team and individual level.

Employees need to know what their organisation is trying to achieve and how their role is helping to
achieve this. It follows that the process will be aligned to the strategic planning timetable of the
organisation.

1
© Chartered Institute of Internal Auditors
 The performance management framework

Many organisations have an established organisational performance management framework. It

usually begins with an assessment of personal objectives and competency targets through a series
of meetings between the employee and line manager. This enables an employee to play an active
part in the process putting forward ideas and exploring opportunities for personal training and
development.

To enable a meaningful discussion and successful outcomes sufficient time is needed for employee
and line manager to prepare.

This might include:

• Reviewing of the previous plan, noting the extent to which targets have been met and any
obstacles to success.
• Receipt of feedback information from the line manager since the last meeting along with
supporting information to back it up.
• Responses to line manager feedback. Any training and development required for current and
future job roles.

As well as this approach organisations may adopt a 360 degree feedback methodology whereby
peers, team colleagues and customers provide a written assessment, often in questionnaire format.
Some organisations adopt this alternative approach for management level employees.

The next step is to record information in a performance appraisal document, as a minimum some

2
© Chartered Institute of Internal Auditors
 kind of questionnaire should be used to maintain a consistent approach that includes objectives,
competences and training and development actions.

Progress against the appraisal plan is also an important part of the cycle, with reviews and updates
normally taking place every 6 or 12 month but this may be more frequent for new employees.

The timing of performance appraisal should link into the organisations planning cycle and financial
year. However feedback on performance can be given on an on-going basis to enable continuous
improvement and not just during formalised performance appraisals.

Where there is a skills gap support options include training, coaching and feedback. An engaged
employee is more likely to take pride in their job and show loyalty to the organisation.

The basic performance management cycle is represented as follows:

For performance review meetings to be effective training should be provided to managers and
employees. For managers the emphasis will be upon their role in the process, objectives of
performance management and how it will operate.

While for employees training tends to focus upon being clear about how the process works, what is
expected of them, objectives setting and review.

Why is performance management important?

1. Performance management generally forms part of the organisation's strategic management of

3
© Chartered Institute of Internal Auditors
 human resources designed to deliver long term sustainable success.

2. Everyone in the organisation should know what the organisation is trying to achieve and how their
role fits into the organisation to help achieve the organisation's goals.

3. To enable individuals to develop their knowledge, skills and experience, enhancing job
satisfaction and career opportunities.

4. The recruitment process will have identified the individual as being the right person for the job,
with any skill and knowledge gaps being covered through on and off the job training to achieve the
standards of performance required.

5. To ensure that customer requirements and goods and services are provided to agreed standards
and quality.

6. To ensure that organisation's performance is achieved and improved upon.

How can organisations approach performance management?

Performance management will be effective when organisations enable individuals and teams to take
responsibility for continuous improvement of business processes and their own competencies. For
many people this forms part of their continuous professional development (CPD) and means
objectives need to be clearly defined and agreed with individuals with specific targets.

The SMART acronym is a useful way of getting objectives right:

• Specific - state a desired outcome what needs to be achieved?

• Measurable - how will the manager and employee know when an objective has been achieved?
• Achievable - is the employee capable of achieving the target, but at the same time is it
challenging?
• Relevant - to the team/department/business?
• Timebound - when does the objective need to be achieved?

Performance management may be linked to performance-related pay (PRP). It is thought that it can
motivate people in their work; deliver a message that performance is important and be a fair way to
reward people according to their performance, such as an increase in basic pay, accelerated
progression up a salary scale, one off bonus or share options.

In summary, organisations need to be clear on the purpose of their performance management

system to enable them to assess how the performance management system should be designed
whether the main focus is to be rewards, learning and development or high performance. There also
needs to be a defined process that everyone understands that can be applied consistently.

Potential risks and responses

1. A lack of appreciation among staff of how performance appraisals will help the
organisation achieve its objectives and help them personally in the work they do and their
development.

4
© Chartered Institute of Internal Auditors
 Potential impact
• Strategic plans and priorities may not be achieved, having a significant impact upon the
organisation's reputation and financial performance.

Possible response
• Corporate and departmental objectives are clearly communicated throughout the organisation.
• Design a framework with written guidelines that requires standard documentation to be completed
to ensure the relevant areas are covered.
• Training is provided to be both staff and managers on the performance appraisal process -
objective setting, monitoring, etc.

2. Sections, departments or subsidiaries may fail to complete staff appraisals or miss

deadlines.

Potential impact
• Denying some people access to the training and development they need having an adverse
impact upon performance in specific departments, sections and teams.

Potential response
• Timetable to be implemented and responsibility allocated for monitoring to ensure that
performance appraisals are completed on time. HR Department enforces strict
schedules/guidelines and checks upon progress.

3. Lack of coordination of training requirements.

Potential impact
• Value for money and effectiveness in providing training courses is not achieved.

Possible response
• A process is devised for the prioritisation of training and development linked to strategic
objectives.

4. Lack of equity - some people have more training opportunities than others.

Potential impact
• Some people are denied access to training and development they need, leading to poor staff
morale, failure to develop the potential of staff and reduced performance.

Possible response
• HR department monitors and reviews the consistent use of the performance management
process.

5. Training and development that seems to have little or no relationship to a person's role
or future role.

Potential impact

5
© Chartered Institute of Internal Auditors
 • Money, time and effort wasted on unstructured training with reduced performance and
revenue/profits.

Possible response
• Training and development is directly linked to job descriptions and personal targets - HR
department reviews application of budgets.

6. Managers who fail to review and evaluate the staff appraisal process, which enables
inconsistency in application.

Potential impact
• Strategic plans and priorities may not be achieved. Ineffective performance appraisal process.

Possible response
• Documentation of policies and procedures with regular review by HR.

7. Failure to appreciate the importance of security of personal data resulting in loss or

theft.

Potential impact
• Breaches to legislation leading to fines and compensation.

Possible response
• Documentation of policies and procedures with regular assurance by third party.

What factors should you consider?

1. Consider the justification of such an audit engagement in relation to the strategic risks of the
organisation. How does this particular audit or combination of audits satisfy assurance
requirements around one or more high priority risks? For example the timing and prioritisation of a
review may be linked to a wider programme of change in the organisation that includes
development of human resource management.

2. Due to the nature of the work discuss the objectives of the audit engagement well in advance with
senior management. Place emphasis on verifying risk mitigation, particularly in relation to
compliance with legal and/or regulatory requirements.

3. Discussions on scope should consider whether there are links to manpower planning,
recruitment, turnover and whether employee surveys will be included. Also will it cover all areas
of business activity in all locations?

4. This sort of internal audit work involves files and documentation about people and is therefore a
sensitive area. While the internal auditor is likely to be interested in procedures it is
understandable and necessary to maintain confidentiality. The way that the audit will be
conducted needs to be discussed in advance to protect personal data otherwise there will be
delays.

6
© Chartered Institute of Internal Auditors
 5. To what extent has management defined policies and procedures, established criteria for
success and implemented monitoring (KPIs) and reporting arrangements? Does this include
assurance as a second line of defence?

What can internal audit do?

1. Assess whether risk management is effective

We have recognised performance management is closely associated with the overall performance of
the organisation and identified in our table some of the risks that may occur and their potential
impact.

Internal audit has an important role to play in evaluating whether risk management processes in this
area are working effectively, that the reporting of risks is complete and accurate and that risk
mitigation has been applied and is working.

3. Review risk registers

To begin with, internal auditors can review risk registers to ensure that risks in relation to
performance appraisal have been adequately identified and assessed, according to the risk
management process within the organisation, and that managers are working to and within risk
tolerances.

Where there has been no assessment of risk, internal audit could encourage management to
facilitate a risk workshop, providing advice and guidance as part of internal audit's consultancy role.

4. Gather and review evidence

Internal audit can gather and review evidence to determine how well risk responses are working
using a range of compliance and substantive tests. This may involve considering how well the
organisation's policies and procedures have been applied to reduce the potential impact of risks and
whether or not defined outcomes have been achieved.

In relation to performance management internal audit is ideally positioned to consider whether

individual and organisational performance is improving and that objectives at various level of
management are being delivered. The level of audit testing could be structured according to the
importance of the objective/outcome.

Other outcomes to consider in the scope of a performance management audit include:

• Is the performance management process efficient?

• Has investment in personal development been focused upon the areas that most need it
(including technical and soft behavioural skills)?
• Are objectives achievable and challenging (SMART)?
• Has training & development been delivered and has it been effective?
• Under performance has been appropriately managed. Is there equity and consistency within the
performance management process?
• Does performance related pay improve performance?
• Does the reward system encourage excessive risk taking outside tolerance levels?
• Talent is appropriately managed.
• Do security measure prevent the loss or theft of personal data.

7
© Chartered Institute of Internal Auditors
 5. Assess HR processes - but not be an HR expert
As a result it is important for the internal auditor undertaking an audit engagement in the area to be
competent - have sufficient knowledge, experience and appreciation of performance appraisal
processes to perform the review.

This does not mean that the internal auditor should be expert in human resources but should be
able to recognise the existence of problems or potential problems.

For in-house internal audit functions, the knowledge and application of the organisation's process
should provide a good starting point for an audit review.

6. Assess the reliability of KPI measurement

Internal audit may find that HR management are providing assurance and information upon the
mitigation of risks. Where this takes place internal audit can review the reliability of the assurances
and the accuracy of reports.

For example, HR services may report on how well departments are applying performance appraisal
procedures and report against key performance indicators. Internal audit can provide an independent
opinion on whether senior management can depend upon the statements being made and scope
their work accordingly.

Further reading from our HR series

Employee engagement
Recruitment and selection
Reward and recognition
Talent management
Training and development

Practice advisories

Practice advisory 2050-3 provides detailed guidance on how to rely on the work of other assurance
providers.

8
© Chartered Institute of Internal Auditors