Infusing Agile in Internal Audit

Sprinting from backlogs to breakthroughs

Agile internal auditing has been trending in the market since 2018, the same year we at Deloitte published our own Agile Internal Audit (IA) Manifesto. Since then, many internal audit functions have adopted Agile ways of working, and many aspire to do it. Their common desire is audits that deliver more valuable business impact faster, with happier teams and stakeholders in a rapidly changing business landscape. 

Some have tried but stalled, reverted to traditional ways of working, or conducted a brief experiment and abandoned it. If there’s a common thread among places where Agile IA fails to take root, it’s this: thinking of Agile as a process rather than a mindset. “Don’t do Agile; be Agile,” one often hears. Thinking of Agile as a process is a well-known trap.

Approaching audit agility

It’s common to conflate scrum and agile. Scrum is a fairly prescriptive framework that sometimes comes under attack as being limiting. This is an entirely fair criticism. However, it remains a highly useful means to an end because it’s a new (to IA) way of organizing work that helps enable the Agile mindset—things like limiting work in progress, focusing on value, and delivering iteratively. 

When we provide training to teams embarking on Agile pilots, we ask them to say in unison the words “Agile process,” after which we express hope that’s the last time that phrase ever passes their lips. We teach Scrum—but as a starting point. Agile is a mindset, and as we said in our manifesto, “one size does not fit all.” The methods must be adapted for your needs, and your approach to Agile should focus on the value mindset, learning, and adaptation. 

Applying Agile principles: Client tales

One of our clients nearly fell into the agile-as-process trap. Consequently, they struggled with adoption and pushback. However, once they pivoted to emphasizing mindset over process, teams started feeling more freedom to adapt methods to focus on value. They’ve since committed to a journey of learning and adaptation, retaining elements of Scrum as tools in their kit.  

Another client asked us to assess their Agile adoption four years after we had initially coached them. We observed that they no longer worked in sprints but delivered completed work iteratively throughout the audit instead of the all-at-once approach. The organization and its leaders had adopted key elements of the Agile mindset—limiting work in progress, focusing on value, delivering iteratively—even as they had moved beyond Scrum.

At first, I was worried that we were missing something because we weren’t doing the process exactly as you had taught us. But as it turned out, Scrum was a means to an end. We never would have gotten that mindset embedded in our DNA if we hadn’t done Scrum first.” —CAE, insurance company

Scrum for audits, mindset for success

Here’s the takeaway: Just as one wouldn’t stop learning a new language after learning to ask directions to the library, neither should your IA function stop its Agile journey after learning Scrum. Leave space for continued learning, and don’t conflate the mindset of Agile with the framework of Scrum. 
 

Next in the series: How to use Scrum as an important first step.