What is Agile Auditing?

Published: Apr 22, 2020
Share

The world around us is constantly changing with new concepts and risks emerging. In order to deal with such dynamic issues, dynamic solutions are required. Traditionally, projects are planned and executed in a linear manner. But the traditional project management method doesn’t always cut it. This is where the agile approach comes in. Even though agile project management originated in software development, it can be useful for other environments as well, including internal audit.

The agile approach focuses on individuals and interactions rather than processes and tools. Agile emphasizes an iterative structure that provides flexibility, efficiency, and increased transparency. Due to its iterative nature, agile allows for less planning upfront and greater flexibility when problems arise. Additionally, agile employs a more collaborative approach to problem solving which is made possible by the increased transparency towards clients, and the involvement of the entire team in decision-making.

Companies face unpredictable market conditions, regulatory changes and emerging risks. Because of this, the agile approach is being utilized in regard to internal audit functions. As explained above, the agile approach is based on flexibility and collaboration, and these same principles would work well with the unexpected issues that may arise during an audit. As internal audit functions are asked to provide more impactful insights and expected to react quickly to shifting priorities, become more anticipatory with regard to risks, and incorporate a more risk-based approach, agile auditing may be the answer.

There are a variety of methods used in agile auditing, and most share basic characteristics. An audit backlog is created that contains a listing of audits or tasks. These audits and tasks are prioritized by organizational risk. The log is continuously updated based on the needs of the organization. Audit teams start at the top of the audit backlog and work their way down until all audits have been completed. The top of the log is the most important and relevant at that specific time. After an audit is selected, the audit is broken into small increments called stories. Stories are tasks that can be achieved within sprints. Sprints are time-based intervals where audit work is conducted. They provide a process, structure and cadence to the audit work schedule. Sprints typically last one-to-two weeks. At the end of each sprint, completed work is demonstrated to the business stakeholders within a “stakeholder touchpoint.” As the audit work is being conducted, a scrum master or audit manager serves as the team facilitator, and ensures the audit process is followed, and is completed on time within budget. This audit structure allows for flexible risk-based procedures to assist internal audit functions.

Agile internal auditing defines a shorter path to more insightful results with repetitive one-to-two-week sprint touchpoints which engage stakeholders earlier and more frequently. The audit backlog creates the ability to employ a more risk-based approach and empowers internal audit teams, along with business stakeholders, to decide what to do, how much to do, and when to do it. Agile auditing is a relevant and impactful methodology that addresses the challenges internal audit functions face today.

It should be noted that the agile approach, and in turn agile internal auditing, (or, for that matter, traditional approaches) may not be the best method in every situation. When considering using the traditional approach versus the agile approach, one should determine the following:

Are the project requirements clear? If the requirements of the project are likely to change or are imprecise, then agile is the better choice. If the project is well-defined and predictable, the traditional method may be preferable.
Is the project prone to undesirable threats? The rigid nature of the traditional approach makes it an undesirable choice, while the flexible, task-based approach of the agile method allows unforeseen risks to be handled without derailing the entire project.
What is the size of the team? The agile approach works best in smaller groups of experienced team members focused on collaboration and flexibility. The traditional method is better suited for large and multifaceted teams.

Next time the team begins planning an audit, bring up some of these questions. Depending on the answers, implementing an agile audit may be the right decision.

PRTS Intelligence Newsletter - Q2 2020