Becoming Agile: Elevating internal audit performance and value

Enhancing value through a unique point of view
Since 2002, Sarbanes-Oxley (SOX) testing has been the bane of auditors’ existence. Even though it’s an annual assessment and the timeline and scope rarely change, it seems to catch us off guard like a runaway train, challenging us time and time again.

A shift to the Agile mindset can help SOX departments operate in a way that adds stakeholder value. Collaboration driven by Agile creates an environment where teams remain aligned and coordinated, whether working together in person or remotely around the globe.

Integrate security into DevOps
The primary objective of continuous delivery with DevSecOps is to make software deployments painless, low-risk events that can be performed incrementally, at any time, and on demand. It dissolves the barriers between development and operations to generate value quickly with quality and stability.

Automation can offer many benefits, such as continuous monitoring and workflow management. Teams often rely on these tools to enable developers to identify and address security vulnerabilities that previously wouldn’t have been detected until after the product had been moved into production.

Bringing development and operations together into a cohesive approach opens the door for software development teams to attain a new level of efficiency and effectiveness. If Internal Audit can bring this point of view and mindset to DevSecOps-related audits and consultations with technical teams, compliance and DevSecOps efficiencies can amplify value creation.

Ready to respond
The disruption of 2020 caused organizations to completely rethink how to conduct business and be effective. COVID-19 gave us the use case to test how we would deal with unique environments and still be effective.

While each organization has had its own stories of perseverance, the Agile IA transformation journey of one medium-sized power utility, going on since 2018, enabled its internal audit organization to respond, recover, and thrive.

Through a journey of more than two years—sensing, responding, and adapting to what works—this organization had started to reach a higher level of Agile organizational maturity. These advanced Agile IA transformation initiatives helped set up this organization for success in dealing with massive disruption during COVID-19.

Aligning the IA to organizational strategy
Successfully adopting Agile within IA isn’t easy. It takes skill and concentrated effort, and the Standards aren’t an obstacle. They complement and support the adoption of Agile IA practices. In fact, Agile works quite well within the Standards, and, in certain areas, it embodies and optimizes the principles-focused intent of the Standards.

Each IA function must determine the appropriate way to follow the IIA Standards. But we have yet to note any instances where Agile has created conflict with the Standards. On the contrary, we have observed many cases where traditional norms and processes become more efficient by applying Agile techniques. We believe Agile can help equip an IA function to strengthen its compliance with the Standards.

The comfort of Agile
For many companies, Agile methodologies are beginning to gain ascendancy over traditional Waterfall development. The development process differs between the two approaches, including the frequency of delivery and the team structure.

When auditing, the intent is to add value, not hinder the pace of a project. For Agile projects, there are numerous opportunities to achieve these goals, so it makes sense to bring the IA team on board at the beginning of the project.

Flexibility and adaptability need to imbue the approach. Specific sprints, areas of functionality, or aspects of the project may require more attention; this way, IA teams can adjust the audit plan as different priorities emerge.

The journey to agility
Internal audit groups are continually challenged to provide more value to stakeholders while enhancing organizational influence and impact. The need to change is clear, and the time for change is now, but how should you navigate the road ahead?

Stakeholders demand more efficient assurance, better advice on processes and controls, and greater anticipation of risks. In reports, they want deeper insights and stronger points of view.

Instead of sporadic initiatives and piecemeal solutions, IA departments need an updated change methodology—Agile Internal Audit—which, in Deloitte’s view, is most readily applicable to internal auditors’ current challenges.

When adopting Agile, Internal Audit should shift
The concepts of Agile IA are simple, but they have shown to be more challenging to implement than one would think and require deliberate change management.

The mindset change is not easy, but the potential benefits are worth it, from reduced time from start to finish, more insightful observations and recommendations, collaboration with stakeholders, and an effectively engaged internal audit team.

Decentralization of decision-making is key to Agile IA and can be a difficult switch to make. The team must be self-organizing and empowered to make decisions about what to do.