Agile Values and How Internal Audit Can Apply Them

What is Agile and why is it relevant to internal audit (IA)? Agile is defined as the ability to create and respond to change.[1] Agile is both a mindset and an approach. For IA to remain effective and relevant in our ever-changing risk environment, more IA practices are turning to Agile. Agile IA is a methodology designed to enhance value and enable efficient, flexible and responsive IA functions. While Agile methodology was originally created for and applied to software development functions, Agile values and principles have evolved and apply to many functional areas including IA. The following is the first of a three-part series examining Agile's foundational values and how IA can apply Agile to become more efficient and effective.

What is Agile Internal Audit

Agile IA is an approach to IA that leverages Agile values, principles and techniques to transform planning, performing, executing and reporting phases. The purpose of adoption is to enhance the audit process through increased collaboration, shortened audit lifecycles and increase transparency of the audit process and results. Each organization may implement slightly different approaches to Agile IA based on the organization's preferences and capabilities, but, for the most part, they all include common Agile concepts such as work backlogs, cross-functional collaborative teams and shorter audit lifecycles.

Agile Values

The Agile methodology applies four core values:

These values advocate building concentrated cross-functional teams that provide enhanced attention to fluid processes and eliminate bottlenecks. Results include improved quality, collaboration, stakeholder engagement, transparency and responsiveness to change. Management can leverage these improvements and find creative ways to apply Agile methodology and core values to enhance a wide array of processes and teams.

IA departments considering implementing Agile methodology and adopting its core values may realize some of the same benefits observed in other Agile environments including increased quality and shortened product (e.g., audit) delivery times. Below, we present how Agile values can benefit IA processes.

Value One – Individuals and Interactions Over Processes and Tools

The flexibility of cross-functional teams is a core principle of Agile project management. The focus on individuals and interactions over processes and tools places increased significance on how people operate within a business environment as small, adapting teams. Where processes and tools are less responsive to change, cross-functional teams, which share different experiences and solutions to problems, are significantly more adept. This value relies on the premise that teams not dependent on rigid processes can repeatedly and quickly generate positive results in a continuous changing environment due to their ability to share information and respond in real time.

For IA functions, creating an environment in which cross-functional team members are empowered to collaborate and share information can result in identifying bottlenecks that introduce risks to the quality and timeliness of product delivery. Fluid and candid conversations about project risks, delays and dependencies alerts leadership to previously hidden aspects of an individual audit or entire audit plan. By enhancing the focus on team members over processes and heavily utilized historical practices, the team can better meet the expectations of IA leadership, auditees and audit committees.

Value Two – Working Products Over Comprehensive Documentation

Working products over comprehensive documentation[2] reallocates valuable time and effort away from extensive documentation and toward product delivery. The goal of this value is not to eliminate the requirements for documentation, but to optimize the documentation created based on the value it provides. By removing unnecessary, non-valuable documentation steps, team members can direct attention to activities that add value to products.

While thorough documentation persists as a key tenet of the IA lifecycle, overly detailed requirements present a common bottleneck. The completion of checklists and forms not critical to key deliverables increases the time required to plan, scope and execute audits. To apply this value to IA processes, IA departments should evaluate audit documentation to determine purpose and relevance based on the demands of individual audits and department objectives. This provides the opportunity to remove unnecessary documents, prevent redundant activities and depart from a "same as last year" (SALY) approach to audit documentation that does not drive new outcomes.

Value Three – Customer Collaboration Over Contract Negotiation

The purpose of customer collaboration over contract negotiation is to facilitate continuous conversations and solicit ongoing feedback regarding the objective and requirements of a product. This shift in communication from definite to fluid allows teams to identify and respond to changes of the end users' needs. Additionally, this value promotes collaboration on the content and context of products, providing transparency which results in a final product that better meets expectations. This value has evolved common product development methodologies, such as user-centered design (UCD), which focuses on the products end-user's wants throughout development.

Communication and collaboration during an audit are key indicators of success and customer satisfaction. In a traditional audit cycle, communication occurs at the end of each audit phase (planning, fieldwork, reporting) and quarterly with the Audit Committee. IA departments should consider the frequency of their communications with key stakeholders and customers, including business functions, external auditors, regulatory or compliance functions, the Audit Committee and Board of Directors. While maintaining milestones for obtaining formal approval remains critical, establishing iterative review sessions with business functions ensures that changes to business objectives, risks and controls impacting the direction and nature of an audit are addressed. Consistent collaboration promotes engagement and provides the auditees visibility into the progress and content of audit deliverables, limiting the impact of disagreements or surprises over contentious items such as audit findings.

Value Four – Responding to Change Over Following a Plan

Responding to change over following a plan[2] places importance on a team's ability and need to adapt and adjust to change rather than hold steadfast to preconceived steps. By restricting activities to a defined plan, teams inherently miss the opportunity to innovate and evolve. This perpetuates a cycle of stagnant, repeated efforts without consideration for necessary adjustments.

In contrast, establishing a culture where change is welcomed allows IA departments to remain dynamic and responsive. In this environment, IA departments can predict and prepare for impending changes, gaining time to proactively adjust or develop strategies. Changes can impact entire IA departments and individual audits. Economic downturns, variation in resources and auditability of business partners can affect the ability to deliver audits on schedule and meet department goals. IA should consider regularly reviewing and adjusting risk assessments, audit plans, and goals to reflect and respond to the identified impacts.

Agile Audit Approach

An Agile IA department is typically organized into cross-functional teams (approximately four to six members per team, with different skillsets). Audits are divided into smaller units that are assigned to cross-functional teams to be completed within two to four-week periods or "sprints." The audit cycle is collapsed resulting in less division between planning, risk assessment, fieldwork and reporting phases and a backlog of tasks is used to manage, prioritize and complete the work.  Team members can complete a task and then review the audit backlog list to select the next task based on priority or risk. All audit work is completed with the end-product in mind, which can blur the lines between audit phases. Teams hold daily stand-ups to review completed tasks, prioritize tasks for the current day and to discuss any roadblocks or challenges that may require the team to change its approach.

Although, IA departments continue to use GRC tools to document work, Agile IA departments are utilizing collaborative tools such as VersionOne or Rally Software. Retrospective reviews or look-backs are completed after each audit to continuously identify opportunities to improve the audit process.

Conclusion

IA departments that implement Agile values can realize benefits including improved quality, collaboration, stakeholder engagement, transparency and responsiveness to change. The second part of this series will discuss how IA departments can apply common Agile tools to current processes in their journey to become more efficient and effective.

References:

[1] https://www.agilealliance.org/agile101/

[2] https://agilemanifesto.org/