Across all industries, COVID-19 has tested our capacity to respond quickly and effectively to seismic changes in economic, social, and professional life. But while the cause of these challenges is unprecedented, the need for a nimble response is not new. In many areas of business, the global pandemic has not created new problems so much as it has revealed preexisting shortcomings—namely, the cumbersome processes and bloated bureaucracies that impede rather than propel work and make it difficult to respond rapidly to change.
In the auditing field, coronavirus has merely shone new light on what we already know: That it is impossible for internal audit teams to predict market disruptions, regulatory changes, and cybersecurity and data privacy threats. That the traditional annual audit cycle is an overwhelming process that fails to provide the flexibility companies need today. That we must radically improve our ability to offer timely assessment and advice in order to meet the demands of this new world.
In this crisis, the insights internal auditing teams provide are more valuable than ever. But in order for organizations to reap all of those benefits, our process needs to evolve. With its emphasis on flexibility and timeliness, agile methodology could be an effective tool in your team’s effort to rise to this extraordinary occasion. Evangelists for the method claim that it leads to better communication, iterative planning, increased flexibility, quick and effective responses, and empowered team members—all while improving audit quality, reducing costs, and saving time. Could it be the right tool for your team?
What is agile methodology?
Agile methodology (or simply “agile,” as it is often called) emerged in the early 2000s from the software development field. In short, agile breaks development into shorter stages of activity (often called “sprints”) that include planning, testing, and quality assessment, which are designed to reach an overarching project goal within a budgeted timeframe. Each of these shorter stages produces results (a product or insight) that can be shared with the client to add immediate value. Agile brought under one methodological umbrella developers’ longstanding preference for an iterative and incremental process, wherein more than one stage of the development cycle may be in progress at the same time, over the “waterfall” process, which dictated the completion of one step at a time, with any product or business value delivered all at once at the very end of the project. Agile development allows for business value to be delivered throughout the process and provides opportunities to assess and alter the course of the project based on results, new information, and the client’s changing needs.
The values of agile methodology were recorded by a group of software developers in 2001 in the Manifesto for Agile Software Development, which champions the following:
- individuals and interactions over processes and tools
- working software over comprehensive documentation
- customer collaboration over contract negotiation
- responding to change over following a plan
Put another way, agile acknowledges the value of tools and processes, quality documentation, a thorough contract, and a thought-out plan, but it aims to prevent projects from becoming hamstrung by mindless devotion to protocol and terms over efficiency and results.
If you’ve ever been in a situation in which clear solutions were being blocked in the name of upholding a process set up months or years ago, then you understand the premise of agile’s flexible approach. Some have argued, however, that agile goes too far in its rejection of long-term planning, noting that the methodology’s emphasis on adaptability provides an excuse for teams to move the goalposts of a project whenever it suits them. But according to one of agile’s principal authors, Jim Highsmith, the agile movement “is not anti-methodology” but rather seeks “to restore credibility to the word ”: “We want to restore balance. We embrace modeling, but not in order to file some diagram in a dusty corporate repository. We embrace documentation, but not in order to file pages of never-maintained and rarely-used tomes. We plan, but recognize the limits of planning in a turbulent environment.”Agile methodology contends that meaningful, effective work must be oriented not toward checking off the steps in a plan but toward the business goal itself.
The benefits of agile auditing
Applied to auditing, agile methodology breaks down the audit process into smaller stages that can be accomplished quickly with regular deliverables. For many in the auditing field, this is a revolutionary and potentially uncomfortable way to think about our work. We’re used to creating rigorous, detailed plans, often years in advance, and sticking to them. We use these plans to evaluate our progress and effectiveness. But jettisoning an obvious solution in order to stick to a plan is the opposite of agility, and agile auditing can benefit both companies and internal audit teams in several important ways:
- Agile auditing enables rapid responses to changing business needs. The flexibility afforded by agile methodology allows auditing teams to be more adaptive, so they can respond to changing needs and priorities and add greater value to their companies. Priorities and goals are assessed and adjusted more frequently, at the end of each sprint rather than once at the end of the project. This means that teams can address major issues as they arise or incorporate new insights and objectives as business needs change—say, in response to new social distancing measures.
- Agile auditing centers risk-specific insights. When work and documentation are streamlined, addressing risk takes center stage. By removing the burden of stringent hierarchies and superfluous procedures, agile techniques help auditors stay focused on providing insights and recognizing opportunities that advantage their stakeholders.
- Agile auditing delivers results faster and more frequently. By working in sprints, auditors have more opportunities to demonstrate progress and review procedures. Instead of delivering results once at the end of an audit, teams will obtain and deliver meaningful insights throughout the process and provide assurance to stakeholders in real-time rather than merely retrospectively.
- Agile auditing empowers internal audit teams. Agile methodology allows for greater creativity and control in designing and implementing an auditing plan. Rather than being constrained by a strict hierarchy, individuals work together to make decisions about projects based on insights gained during sprints. In the absence of a rigid internal audit schedule, teams can choose from an ongoing backlog of audits and projects, prioritizing them based on the most relevant risks and the company’s most up-to-date needs.
How to apply agile methodology to auditing
The fundamental difference between agile and traditional auditing is in the length of the auditing plan. In traditional auditing, teams commit to a list of risks and audits at least a year in advance. Prioritization is necessarily based on which areas are the highest risk at the time the plan is determined; if the situation changes even a few weeks after the plan is designed, it is unlikely that new risks will be added or new audits are undertaken until a new plan is developed the next year. In agile auditing, teams design shorter plans with shorter commitment terms—for example, addressing the most critical risks over the next quarter. Within that quarterly plan, testing, review, and results presentations occur within every two- to three-week sprint, enabling constant improvement over the course of the quarter and an enhanced ability to prioritize audits and target risks in the next quarter. Agile methodology gives audit teams more opportunities to prioritize and deprioritize risks and add or remove audits based on the insights they gain from more frequent testing and review.
Beyond the planning stages, teams can also apply agile techniques as their audits are executed by shortening the stages of the audit or conducting several stages simultaneously. For example, in traditional auditing, teams complete all testing before they start reviewing and present reports to management just once at the end of the process. But if testing and review occur simultaneously, and if reports are presented more frequently to management, audit teams will be in a better position to change course when issues arise or priorities change. If the notion of transforming your audit cycle from traditional to agile all at once is overwhelming or impossible, consider shortening review cycles in your annual plan, effectively creating sprints. Try adding more frequent reports to management to create feedback loops; then your team can use the insights gained from these reports to advocate for adjustments to the annual plan. These smaller implementations may help you shift your organization toward agile techniques and values without abandoning the traditional audit cycle.
Conclusion
Whatever its pros and cons in practice, we can all likely agree with agile methodology’s theoretical aim to eradicate low-value work so that talented people can spend their time and effort on the things that make a difference in an organization. For many internal audit teams, the application of agile techniques will require a realignment with their true mission, to address risk, not merely execute a plan. In this moment of historic uncertainty, that mission is more important than ever.
Further reading:
Raven Catlin, Danny M. Goldberg, and Ceciliana Watkins, Agile Auditing: Fundamentals and Applications
Prescott Coleman and Sandy Kasahara, Active Auditing: A Practical Guide to Lean & Agile Auditing
Stephen Denning, The Age of Agile: How Smart Companies Are Transforming the Way Work Gets Done
