The future of internal audit: Adding value through Agile

To thrive in today’s era of disruption, businesses must be poised and ready to swiftly adapt to new opportunities as they arise—and the internal audit (IA) function of the future has an integral role to play in helping seize them.

These new expectations require flexibility in the areas of audit planning, execution, and reporting—flexibility that was not always possible within traditional IA frameworks. To move at the speed stakeholders demand and provide the level of support organizations expect, IA needs to consider new approaches to help deliver valuable insights quicker.

For a growing number of organizations, Agile IA is that new approach—and the key to increasing stakeholder engagement. An Agile audit uses an iterative, time-boxed approach to planning, fieldwork, and reporting. Audits are executed by self-organizing teams that emphasize collaboration, encourage frequent communication with stakeholders, and promote continuous improvement.

While this audit method is relatively new, it is quickly rising in popularity. In Deloitte’s recent global research survey, The innovation imperative: Forging Internal Audit’s path to greater impact and influence, 56 percent of chief audit executive respondents said they’re either already using Agile methods, or considering using them soon. Those that have embraced an Agile approach have realized a host of benefits—including more timely audits, streamlined documentation, engaged clients, empowered IA teams, and insightful results—with over half of respondents using Agile methods reporting that they have high impact and influence in their organizations.

At a time when only 33 percent of IA teams believe their function is viewed positively by the rest of the organization, Agile offers the opportunity to increase stakeholder engagement. Not only can Agile practices empower IA to adopt a more creative, solutions-oriented way of thinking but, in doing so, it can also get the function recognized for adding value faster.

Guiding Agile principles

Making the shift to Agile requires a shift in audit thinking. While this may be challenging, the transition can be made easier by focusing on a number of key Agile principles.

1. Make value front-and-centre
   One of the benefits of Agile is that it encourages IA teams to clearly articulate the area of audit focus and identify the value the audit will bring to the organization before it even begins. For instance, while audits have historically taken a waterfall approach where the auditor attempts to assess the full spectrum of risk, an Agile approach would focus on the areas of greatest risk through iterative sprints, beginning with a discovery exercise focused on identifying the most critical risks.
   
   Agile in action
   In a bid to improve IA outcomes, we worked with an IA function to embrace Agile principles in its audit of an in-flight customer facing IT project. Understanding that the project was nearing the end of development, the first sprint was planned to drive the most value—focusing on user acceptance testing, security, and training. The results of the two-week sprint were shared with management immediately after completion, allowing the company the ability to integrate the timely lessons learned from this sprint in advance of launch.
2. Prioritize collaboration
   Collaboration is a huge component of Agile IA—and critical to its success:
   
   i. Collaboration with the person or group being audited
   By focusing on intended value and outcomes, an Agile approach can help mitigate what is sometimes an adversarial relationship between auditor and auditee. So rather than unilaterally informing a business function that it will be audited and when, an Agile team would work with business stakeholders to identify how existing risks are being managed and how IA can help mitigate identified gaps. The most successful Agile IA teams hold workshops to obtain stakeholder perspectives, understand their perceived risks, and cooperatively establish a plan to improve the process while reducing risk.
   
   ii. Collaboration within the IA team
   Agile IA is very focused on creating a team environment and fostering ongoing interaction—not the least of which is the daily stand-up. This involves putting the entire IA team together in a room every morning for 15 minutes to discuss yesterday’s events, today’s agenda, and the different roadblocks they are facing. It is run by the “scrum master” and is intended to be a non-judgmental forum designed to drive progress, uncover issues, and brainstorm how to get past them.
   
   Agile in action
   One organization’s Agile practices include a data lab, which is a collaborative data discovery approach where the team gets together to “time-box” a workshop and explore data through a visualization tool. Through this approach, the audit team has repeatedly identified areas that drive additional value and identified anomalous transactions that need additional investigation.
   
   To help streamline a specific audit, a company worked with us to put together a multi-functional scrum team with a heavy data analytics slant to test different hypotheses using data from various systems. The team was co-located and determined its daily tasks and impediments through morning stand-up meetings. This approach allowed the team to brainstorm together, change the testing approach, and focus on the issue most important to the auditee.
   
3. Commit to continuous improvement
   Agile is built around learning from, and continuously improving upon, past behaviour. So rather than engaging in the same processes—and focusing on the same risk areas—year after year, an Agile IA team will have the flexibility to adjust its next audit based on information gleaned from the last one. For instance, if the audit revealed that one division had well-established processes, an Agile IA team may choose to focus a larger portion of its next audit on riskier groups.

Managing expectations
While these key principles are important to keep in mind when launching an Agile journey, it should be noted that Agile is not a rigid process with a predefined scope. It’s up to you to establish the context of Agile within your organization and choose which of these principles to adopt. In a similar sense, Agile is not meant to transform your IA team overnight. This method is based on incremental change—which makes it important to plan your path and allocate resources appropriately.

When you do so, the benefits can be significant. Agile IA teams are more engaged, collaborative, and creative—and capable of meeting the needs of their stakeholders in new and innovative ways. They are better equipped to embrace the future of IA, and possess the confidence and organization-wide respect to not only identify new and emerging risk areas, but help their respective organizations leverage risk to power performance.