Many internal audit shops are undergoing a transformation. They are having to adapt quickly to rapidly changing business conditions caused by digital disruption, new technologies, and, of course, the changes forced by the COVID-19 pandemic.
Those that continue as they always have risk falling behind, loosing influence, or worse, getting shut down in favor of an outsourced audit function. Leading internal audit departments have realized that they have to keep up with business units that are evolving at warp speed. They are focusing on change management, adoption of cutting-edge technologies, and implantation of leading business practices. One of those practices that is creating a lot of buzz lately is agile auditing.
So exactly what is agile auditing? While it has many permutations, at its core, agile auditing is working in a way that makes the internal audit function more flexible, able to prioritize value-additive activities, and able to adapt rapidly to changing conditions and emerging risks.
To be sure, using Agile principles isn't a revolution for internal audit, but more of an evolutionary process. Nevertheless, this journey is significant if internal audit is to stay relevant. Agile is easy to consider and conceptualize, but hard to implement, particularly because it requires a shift in mind-set for the complete internal audit team. Functions that create an environment where agile can blossom find that they remain flexible and can implement innovative solutions much faster.
It’s important to note that Agile Auditing can mean lots of different things. But let’s step back for a moment. The Agile (with a capital “A”) project management framework was first developed by software developers to speed and focus the development of software programs. The agile methodology was developed as an alternative to the “waterfall” production methodology where each part of the project led to the next part, and the project “flows” along a dedicated path. With Agile, different parts of the project can be under development at the same time. It uses several unique methods and practices to prioritize development aspects and focus developers on the task at hand. There is also agile, with a lowercase “a.” This is simply adopting practices, tools, and techniques that make the internal audit function more flexible and adaptable. Here we will be coving some of the principles of the former, Agile Auditing.
Internal audit has borrowed some of these project management techniques to enhance its flexibility, speed of execution, and ability to adapt to changing situations. But internal audit need not adopt a pure Agile method to become more agile. Some internal audit functions borrow some practices and not all of them. For example, they might use the Kanban progress visualization tool described below, but not conduct the “sprints” that are central to many Agile development processes. It doesn’t have to be an all-or-nothing proposition. Anything that makes the team more flexible and able to change course quickly will yield benefits. Each internal audit team must decide which techniques work best for them.
That said, through the introduction of the latest techniques like MoSCoW and Kanban, Agile auditing can also increase team productivity and improve morale. It minimizes the waste inherent in endless meetings and repetitive planning and can equip internal auditors with strategies to better adapt to changing risks. The tools for Agile execution are invaluable for continually increasing the ability to provide value-added internal audit services, adapting to changing environments, all while also improving communication among participants and collaboration across the organization.
Prioritize with MoSCoW
Many audit teams use the concept of MoSCoW to prioritize and plan internal audit activities. The term “MoSCoW” is made up from an acronym. The “M” stands for Must have; the “S,” Should have; the “C,” Could have; and the “W,” Won’t have. (The “o’s” in MoSCoW have been added to make the term easier to remember by spelling out the city in Russia.) The MosCow concept allows internal audit teams to prioritize high-value activities and to reach a better understanding with audit clients and other stakeholders on exactly what those value-additive audit activities should be.
MoSCow also reminds auditors to develop a better focus on what’s most important from an internal audit planning standpoint in a constrained environment, such as the one we have all recently experienced with the COVID-19 pandemic. This is especially important given that internal audit is being asked by senior management to do more with less. Using MoSCoW can enable internal audit teams to more efficiently manage the scope of audits, focus on critical issues, and enable better allocation of audit resources. It is difficult, though, to embrace prioritization methods like MoSCow when auditors have become comfortable with the habit of covering just about everything on a specific audit. Better prioritization through MoSCoW can deliver great value, but it requires time, experience, and open minds.
Get it Done with Sprints
Sprints are one of the key concepts of Agile auditing and involve fixed-time intervals during which planned tasks must be completed. For example, an audit team might lot a maximum sprint time of two weeks to complete a specific task or series of tasks. This requires the internal audit team to remain focused and committed to completing the required tasks within the designated time. Audit executives will likely notice a shift in the mind-set of audit team members, where during a sprint they demonstrate urgency and resolve to overcome any roadblocks and move towards the finish line.
Typically, the work to be performed during the sprint is planned during a sprint planning meeting. The collaboration of the entire internal audit team leads to the development of a working plan. The goal is for the internal audit team members to leave the sprint meeting with a full understanding of what will be accomplished during the sprint time (the next two weeks, for example) and to commit to the work. Once the sprint is planned, the Daily Stand-Up is brief meeting, typically in the morning, to synchronize activities and create a plan for the rest of the day. Team members explain what they did the day before that helped the internal audit team meet the specified goal of the sprint, what they are planning to do in the coming day, and finally discuss any hurdles that need to be overcome along the way.
After a sprint is completed, a Sprint Review discussion is conducted during which audit clients and other top stakeholders go over what was achieved during the sprint and gather feedback on the experience. During the Sprint Review meeting, observations and views of internal auditors and audit clients can be discussed. Audit findings may result from the Sprint Review and a findings form can be distributed to stakeholders for review and further planning. During the Sprint Review meeting, stakeholders are usually also updated on tasks and other details that are planned for upcoming sprints.
After a Sprint Review, a Sprint Retrospective provides an opportunity for the internal audit team to consider what went right and what didn’t and to create an improvement plan to use for the next sprints. Participants will consider the sprint based on the goals that were achieved, those who participated, tools used, and any remaining conflicts or challenges.
Apart from the work done during a sprint, there are typically four types of meetings to oversee the progress of the given sprint project:
Sprint Planning Meeting: A focused meeting to plan an upcoming spring and consider who will be responsible for what tasks, what exactly is to be accomplished, the expectations for progress, and the time frame for the sprint.
Daily Stand-Ups: These are short daily briefings (often 15 minutes or so) to go over what was accomplished during the previous day, review the goals for the next day, and discuss any challenges that may stand in the way of meeting those daily goals.
Sprint Review: A meeting among the internal audit team, audit clients, and other stakeholders to review the work accomplished during the sprint, exchange feedback among participants, and discuss the results and future considerations.
Sprint Retrospective: A session to look over how well the previous sprint did and to consider what should be done differently in the future to advance the process for any upcoming sprint.
See Progress Using Kanban
Kanban is a workflow management and visualization tool, developed in Japan, to help monitor progress on the activities of internal audit that can help drive an Agile internal audit project. It provides a full view of specific tasks that still need to be performed, activities currently in progress, and, those project activities that have been completed. The information is typically precented on a board, sometimes with “sticky notes,” but application of Kanban can vary greatly from company to company and can be physical or digital. Some find the traditional use of Post-It notes on a white board the best means to visualize progress. Information is generally organized into columns of tasks that are planed but haven’t yet started, those that are still in progress, and those that are now complete. A Kanban board can work as a catalyst to discussing problems and bottlenecks and help resolve issues preventing completion of certain activities by the team.
More recently, Kanban boards have been digitized, and plenty of software is now available to facilitate their development. Digital Kanban boards allow managers to easily distribute the boards to team members, particularly with many of them working remotely during the pandemic.
Whatever the platform, Kanban boards provide a complete and real-time view of the status of all activities in a project, helping internal audit teams prioritize activities, focus on work to be accomplished, and explore what might be causing any delays. It is an excellent project-management tool to enable candid discussions with team members and audit clients during the Sprint Review event and facilitate better collaboration and communication among the cross-functional teams during such events as the Daily Stand-Up and other sprint planning sessions.
Evolve the Process with Shu Ha Ri
While sprints are an important part of Agile internal auditing, successfully execution is really more of a marathon and other techniques can help along the way. One of those is the Japanese concept of “Shu Ha Ri” and using it can help internal audit navigate through the Agile journey. Adopting an Agile approach to internal auditing ultimately means transformative change, and it may require a shift in mentality for audit team members. The Shu Ha Ri philosophy can help internal audit through change-management processes and seeing the bigger picture.
Shu Ha Ri is a framework to describe different levels of training and development. While it was first developed to be used in martial arts, it can easily be applied to internal audit to help along the way to implementing Agile. The concept of Shu Ha Ri involves the use of three distinct training and learning styles that build upon each other. In the first stage, “Shu,” the student imitates the form and techniques of the leader, repeating the basic structures and motions without deviating from them, with the goal of mastering the components. Once learned, the student can begin to depart from the learned practices, putting their own spin on what they have now learned. This comprises the “Ha” stage, where the student can begin to experiment with new applications and variations on what they have already mastered. In the “Ha” stage the student begins to innovate and, in the process, learns more about the underlying theories and principles behind the techniques they have learned. In the final stage, “Ri,” the student learns from his own practice, arriving at a new destination, and adapting what he or she has learned to new circumstances.
The idea is that small steps lead to a mastery of the material. We might know this idea as learning to crawl before you can walk. By first focusing on the “Shu” principle, internal audit team members learn the basics and become comfortable with the fundamental techniques.
As team members advance in using Agile principles to delivering internal audit projects and gain confidence with using the techniques, it’s important for audit functions to continually improve, evolve, and find better ways to apply Agile to internal audit. The function shouldn’t be afraid to constantly explore how to push the boundaries of Agile and seek continuous improvement. This is essentially the “Ha” level of Agile. During the “Ri” stage, internal audit functions will master the application of Agile so that it is the norm for everything to be seen through an agile lens.
The path through an agile transformation isn't an easy one and requires months or even years of planning, buy-in from top management and the board, and learning the specifics of Agile internal audit techniques. Those who devote the patience to master such techniques and the time to educate audit clients and other stakeholders on them will find they can drive transformation and realize a much more flexible and adaptive internal audit function.
Those who embark on this Agile journey will also reach a destination where internal audit isn't just providing a better service for its clients, but where team members work smarter and happier too.
Joseph McCafferty is editor and publisher of Internal Audit 360.