Far too often, we as humans jump to implement something well before we have actually and fully thought it out. We are action-oriented that way. You know the sarcastic adage … ready, fire, aim. Bad strategy.
But those of us with years of internal audit experience have learned the value in planning, and how adequate and thorough planning can be one of the most important parts of an internal audit project. We plan what we are going to do and how we are going to do it by starting with answering the why questions. Why are going to do this project in the first place? Then, we move to understand what we want to achieve, and who we are going to do it with. We do this well before we decide what we are specifically going to do and how we are going to do it.
Let us do the same when implementing something like agile auditing. Ready, aim … aim … aim … then fire.
Lions, Tigers, and Bears, Oh My
There is much talk in the internal audit community about “going agile.” And there is a plethora of consultants out there (some good, some not so good) that would be happy to help you carry out a move to agile. Scrums, sprints, stand-up meetings … it could cause a “lions, tigers, and bears, oh my” reaction. This article is not about how to implement agile, and it is not about all the fancy terminology you might want to consider (or ignore) if you move to agile. This is about making sure you have a strategy as well as a clear reason around a move to agile. Knowing the why. And that why starts with an old phrase — begin with the end in mind. So, let us explore what you want to accomplish, and, importantly, why you want to do it. What is the “end” you are trying to achieve, not how you are going to do it… that can come later.
Begin With the End in Mind
When asked recently, “What is the goal of internal audit?” I thought about it and answered: The goal of internal audit is to add value and make a difference. If we continue to point all we do from an assurance and advisory services standpoint to that goal – adding value and making a difference – we will have done our jobs well. So, possibly, you are thinking about a move to agile, or you started a move to agile and it is not going as well as you would like. My recommendation: be clear about what the end goal is that you are trying to achieve so that you are well positioned to add value and make a difference. The WHY.
Perhaps it is to improve relationships in the organization. Perhaps it is to have better engagement with your audit clients/customers. Perhaps it is to improve the cycle time of internal audit projects. Perhaps it is to do a better job focusing on key risks in the organization. Perhaps it is some or all of these, or maybe something else.
A 2019 IIA Global Knowledge Briefing entitled “Agile Internal Audit” states, “Agile audits are fast-paced, repeatable, and emphasize full transparency and collaboration between stakeholders and self-organized audit teams.” Sounds good, but why are you doing this in your organization?
Layout your strategic goals and then begin a move to agile, making sure it is positioned to accomplish these goals. With your goals firmly in mind (the WHY), consider these strategic actions to enhance your chances of success. (Note, were not talking about scrums, and all the other jargon and trappings, as important as they are … eventually.)
As the noted agile auditing expert Toby DeRoche says, “We’re not trying to audit faster; we’re trying to audit the right things at the right time.” Great perspective.
Do Not Tell, But Do Sell, The Plan
Any move to agile should engage the entire organization. Some will need the conceptual and strategic context, and others will need the details and tactics. Who in the organization needs to know what you are planning to do, what the benefits will be, what will be different, and what should they expect? Identifying these and sharing goals with the organization will help others understand the high-level changes to expect, what will be different for them, and why this is important is, well, important. You want support and buy-in. Telling them all this is uninspiring. So, sell them on the change. Sell them on what they get out of it and how it benefits them. (As much as we’d like it to be all about us, it really is not.)
Start with your administrative boss. Then consider talking with other executives and the CEO. After you have garnered sufficient C-Suite support, then on to the Audit Committee or at least the Audit Committee Chair. Still good? Then it is time to engage certain key partners in the organization, such as Compliance and Risk Management. From there, are there people in your organization you might need as vocal supporters? Sell them. After that, are there a few influential naysayers that need to be engaged? Sell them too. You cannot over communicate, and you will want support throughout the organization. Remember, do not just tell… sell. Sell how the organization benefits.
What Gets Measured Gets Done
Now that you have your goals in mind, and these goals have been clearly communicated to everyone that needs to hear them (staff, stakeholders, key collaborators in the organization [like compliance and risk management]), you need to decide what success will look like. But you cannot leave the determination of success to solely subjective words. So, how will you measure the success of your move to agile? So, how will you measure the success of your move to agile. It could be a certain improvement in end of project evaluation scores. It could be reducing the duration of a typical audit project. It could be improving the timeliness of issuing audit reports. It could be the results of a company survey. It could be all these, or other things. What matters is you commit to success measures and track your progress against them. What gets measured gets done. What matters is you commit to success measures and track your progress against them. What gets measured gets done.
Have One or More Champions
Everyone in your internal audit department will need some level of training to be up to speed on what you want to accomplish, and there should be continuous learning and feedback processes set up as part of the process. That way everyone is onboard, comfortable with the discomfort of change, and how continuous improvement will occur. But do not treat everyone as an equal. Who in your department will excel as a champion, or evangelist, for what you want to do? Who will show leadership and passion for turning goals into reality? Make these folks your “champions” and position them for success. Share the transformation “load,” and have one or more champions.
Have an Agreeable Pilot Partner
When you are ready to pull the trigger on your first steps toward agile, do not necessarily make the next audit project on the audit plan the choice to try things out. Be strategic, and pick an audit that is not too complex, not too controversial, not too high-risk, and, importantly, one where you have good relationships and rapport with operating management. They are as much a part of the project as your team is, and they can help create success or spell disaster. This pilot audit project’s area leaders need to be engaging and engaged, understand what and WHY you want to accomplish what you are doing differently, what their role is, and, importantly, what feedback you are looking for from them. Have an agreeable pilot project partner.
Start Small – Crawl Before You Walk
What can most certainly be guaranteed from a move to agile within an internal audit? You will make mistakes, you will learn from doing, you will course-correct, you will onboard new ideas, you will get better and better at what you want to accomplish. As much planning as you do, the real world will get in the way of best laid plans and teach you things you did not anticipate. So, start small. Pick an audit or two that is not too complex, give your team lead(s) some latitude to flex their change management muscles, build in feedback loops, and give it a whirl. Have frequent meetings to discuss how things are going, confirm you are behaving consistently with the plan, and communicate often. Most babies do not go from laying down to full blown walking in one day or the next. They crawl around a lot, and then try standing. They do not get it right at first, and they do fall down a lot. (Usually with a smile on their face.) But they are eventually walking non-stop once they start. Crawl before you walk, … eventually you will be in a full-blown run. (I almost called it a sprint.)
Conclusion
To add value and make a difference. That is how we should position our internal audit functions. We do assurance and advisory work. We do this work not to issue reports, not to complete an audit plan, not to have audit findings … or any of the host of other end products of our work. We do what we do to add value and make a difference. If you are not adding all the value you would like, or you are not making the difference you know you can, perhaps a move to agile is right for you. Keep your team innovative with agile auditingFor many, a move to agile will be a welcome innovation.
But do not jump in headfirst and start implementing. Have goals in mind, have a plan established, have metrics identified and understood, communicate like mad, have internal champions, pilot a project, and have good feedback mechanisms firmly established. Religiously adopt process improvements, and change management protocols. And, before you know it, you will be having stand-up meetings and scrums like there is no tomorrow. For the well prepared, it is not wishing you good luck, but expecting great agile success!
Hal Garyn is Managing Director and Owner of Audit Executive Advisory Services, LLC based in FL.
Internal Audit
IT Audit