It might be useful to look at what other internal auditors (e.g., the financial auditors) use as metrics. Google some terms such as internal audit quality metrics.
Here are some I would consider:
- % of the audit universe covered per audit cycle (annual?)
- #/% of audit findings accepted by process owner
- # of system failures (as indicated by customer complaints, NCM, ...) the audit process failed to proactive detect the causes of