Agile auditing: transforming internal audit to add greater value

Internal audit is in a state of transformation. In many industries, disruptions are bigger, coming faster and require responses that are quicker and more fluid. In this environment, agile auditing can help some organizations adapt and become more flexible. According to the Institute of Internal Auditors’ 2018 North American Pulse of Internal Audit, transformation of internal audit is the only acceptable solution. Chief Audit Executives (CAEs) need to lead the response to disruption with innovative strategies and an equally flexible approach supported by the right talent. To address change and disruption, CAEs need to position internal audit to not only be responsive to change, but to serve as an internal catalyst, challenging the status quo and proactively identifying and focusing on emerging risks. The bottom line: internal auditors need to be more agile.

Setting the baseline – The role of internal audit

While internal audit provides assurance that an organization operates as management intends, the function can also provide valuable insight for improving risk mitigation, controls, business processes and procedures. Evaluating emerging technologies, analyzing opportunities, assessing quality, economy and efficiency, and providing accurate and timely communication represent a fraction of how internal auditors engage on a daily basis. This comprehensive scope of responsibilities provides internal auditors with a broad perspective throughout an organization. That, in turn, positions internal auditors to serve as a valuable resource to executive management and the board of directors in their mission of accomplishing overall organizational strategy, goals and objectives, in addition to strengthening internal controls and governance.

The Scrum Board – A well-known agile auditing tool

Using the scrum board below (a well-known tool of Agile), you can track Baker Tilly’s progress in sharing a series of thought pieces on understanding Agile and its use in internal audit. This scrum board helps us to visualize where we are, where we are going, possible impediments to success and practical applications within internal audit.

Introducing Agile auditing

Agile is relatively new as it relates to internal audit. At its core, Agile is the ability to create and respond to change. It is a way of dealing with, and ultimately succeeding in, an uncertain and turbulent environment. Agile finds its roots in software development. The authors (software practitioners) of the Agile Manifesto chose “Agile” as the concept’s label because the word represented the adaptiveness and responsiveness to change that was essential to their approach. [1] The software practitioners identified four main values, which became known as the “Manifesto.” [2]

Agile Manifesto (written in 2001):

We are uncovering better ways of developing software by doing it and helping others do it.

Through this work we have come to value:

• Individuals and interactions over processes and tools
• Working software over comprehensive documentation
• Customer collaboration over contract negotiation
• Responding to change over following a plan

As part of the manifesto, they added, “While there is value in the items on the right, we value the items on the left more.” This explains the bold emphasis embedded within the values above.

Addressing common misconceptions

When applying Agile to internal audit, a common misconception is that there is not value in items on the right of the manifesto statement. To be clear, documentation, planning, use of processes and tools are still valuable and, in most cases, required to support an agile approach. Applying priority to values (such as individuals, interactions, collaboration and responding to change) is what helps transform the internal audit approach and culture within your internal audit department. To effectively convert to an interaction- and collaboration-driven department, you must first change mindsets; then you can change behaviors. You need to redefine the reason you perform the tasks you perform into a value-driven approach. This new mindset drives your actions to leverage the “items on the right” to derive value from the “items on the left.”

Another misconception is that Agile is a method. Agile is not a method; rather, it is a set of principles that, if adopted in a manner that fits your culture, can result in effective changes in mindsets and behaviors. In internal audit, departments can become too focused on “implementing Agile” instead of “operating with agility.”

One of the most important misconceptions is that Agile must be implemented as a specific method, and that you must use the same defined roles and artifacts as exist in Agile for software development. Agile internal auditing is not a “one-size-fits-all” approach. Instead, you can apply the agile mindset in a variety of ways through people, processes and technology in internal audit. Adopt an approach that fits your objectives, culture and stakeholder expectations.

The journey to Agile auditing

Throughout the journey of exploring agile internal audit, we will be including theoretical and practical applications. The practical applications will include:

• Applying the Scrum framework, including:

1. Sprint planning
2. Sprint goals, backlogs and your definition of “done” in an audit
3. Use of Scrum and/or Kanban boards
4. Implementation of daily “stand-ups” (quick, daily in-person meetings focusing on outcomes and impediments to progress)
5. Sprint review and sprint retrospectives

• Transforming the product owner, scrum master and development team concepts to internal audit teams that are different in experience, levels and locations
• Making faster, real-time changes and updates to the audit plan
• Revisiting how risks are identified as part of the audit planning process
• Using agile principles to adapt testing approaches
• Improving your audit reports to enhance value to the audit committee, senior leaders and business/process owner

Your journey has just begun.