Agile Auditing

Transforming the Internal Audit Process and Value Proposition

Using the Scrum Process Framework
Learning Objectives

• Discuss Agile software development values and principles

as the foundation for Agile auditing
• Define Agile auditing
• Contrast the Agile auditing mindset shift with waterfall
auditing
• Describe the Agile auditing process (using Scrum),
including roles, sprints, ceremonies, and artifacts
• Identify challenges, lessons learned, best practices, and
benefits of Agile auditing
Polling Question

• How did you first hear about Agile auditing?

a) Conference session
b) IIA chapter event
c) Professional services firm event
d) Article or whitepaper
e) Colleague or professional network
f) This is the first time I have heard about Agile auditing
What is Agile Software Development?

Agile software development is an alternative to traditional “waterfall” software

development methodology
“Waterfall” Software Development Methodology The problem with Waterfall:
• Requirements often change
• Delivery of value is delayed until the end
• Final product may not meet needs of user
• Susceptible to bottlenecks and delays
• Does not optimize collaboration
Agile is designed to overcome waterfall problems:
• Welcomes changing requirements
• Incremental delivery of value
• Close collaboration with customer
• Maintains constant work pace
• Focuses on continuous improvement
What is Agile Software Development?
The Manifesto for Agile Software Development

“Agile” is an umbrella term used to describe software

development approaches using the values and
principles outlined in the Manifesto for Agile
Software Development Agile Auditing Adaptation
Manifesto Values – “We are uncovering better ways of
developing software by doing it and helping others do it.
Through this work we have come to value”:
1. Individuals and Interactions over processes and tools
2. Working Software over comprehensive documentation
3. Customer Collaboration over contract negotiation
4. Responding to Change over following a plan
Polling Question

• Has your company implemented Agile?

a) Our IT department has implemented Agile for software
development but Agile has not been rolled out for other
areas of the organization
b) Agile is being utilized at the discretion of individual
functions and is in varying degrees of implementation
c) Agile has been rolled out as a company-wide initiative
d) We have not rolled out Agile, IT or otherwise
e) Not sure
What is Agile Auditing?

agile (little “a”) Verb:

Making the IA process better by reducing inefficiencies in
order to be more “agile” with the goal of addressing
dynamic risk landscapes in a more nimble way
• Process improvement methods (LSS)
• Rationalization of documentation
• Nimble audit plan and risk assessment

Agile (big “A”) Noun:

An innovative IA approach that transforms the IA process
using Agile software development values, principles,
frameworks, and methods with the goal of addressing
dynamic risk landscapes in a more nimble and
collaborative way
• Common frameworks = Scrum, Kanban
• Iterative and incremental planning and reporting
• Trusted, empowered, and self-organizing audit teams
• Mindset shift
 What is Big “A” Agile Auditing?

Agile auditing definition: Agile auditing is the use of agile software development values, principles,
frameworks, methods, and / or practices in the execution of internal audit engagements

“Waterfall” Internal Auditing Methodology Agile Auditing Methodology (Scrum Framework)

The Problem with Waterfall Auditing

• Semi-rigid stage-gate phases Agile IA Addresses Waterfall Shortcomings by Design
• Susceptible to bottlenecks and other inefficiencies
• Insights (value) may be delayed until end of audit • Iterative and incremental planning leverages learnings throughout the audit
• Delayed / awkward discovery of disagreements between audit client and • Sustainable pace of work minimizes bottlenecks and other inefficiencies
audit team • Incremental delivery of audit results and related insights
• Does not take full advantage of, or facilitate, collaboration with audit client • Frequent communication minimizes disagreements
• IT’S NOT DESIGNED FOR AGILITY!! • Enhanced collaboration
 The Agile Auditing Mindset Shift

Source: Deloitte. Used with permission.

 What is Agile Auditing and How Does it Drive Value?

Agile Auditing Value Proposition

Can small IA functions use

Agile auditing to enhance
their value proposition?

YES!
Polling Question

• Have your stakeholders inquired about Agile

auditing?
a) Yes, our audit committee has inquired about Agile
auditing
b) Yes, our leadership team (e.g., CEO, CFO, other
executive) has inquired about Agile auditing
c) Both a) and b)
d) No, we have not been asked about Agile auditing by
any of our stakeholders
What is Scrum?

Scrum is one Agile process framework used to facilitate the

completion of software development projects
• Increasingly applied as a framework in non-software development
projects
• Has become the predominant process framework utilized for Agile
auditing
• Characterized by:
– Iterative planning and delivery of output via time-boxed work cycles (sprints)
– Self-organizing teams with specific team member roles
– Intense focus on value delivery and continuous improvement throughout the
project
– Robust collaboration amongst stakeholders
 What is Scrum?

Sprint Work-cycles (Time- Ceremonies

Scrum attributes: boxes) • Daily stand-up
• Sprint work-cycles • Consistent duration (2- to 4-week work-cycles) • Sprint planning
• New sprint immediately follows preceding sprint • Backlog refinement
• Ceremonies • Sprint start date and end date are fixed • Sprint review
• Artifacts • Sprint retrospective
• Roles

Artifacts Roles
• Project Canvas • Product Owner
• Backlog • Scrum Team
• Sprint backlog • Scrum Master
• Release plan / road map
Agile Auditing Process Overview
Polling Question

• Has your internal audit function implemented Agile

auditing?
a) We are taking the agile (little “a”) approach to become a more
agile internal audit function, focusing on reducing waste and
being more efficient
b) We are in the initial stages of learning about Agile auditing (big
“A”) to see if it fits our strategic vision
c) We have started using some Agile practices like daily stand-up
meetings or working in sprints but have not implemented a full
Agile auditing process
d) We have taken the leap and are executing at least some of our
internal audit engagements using a formal Agile auditing
process (big “A”)
e) We do not currently have any plans to change our existing
internal audit approach
The Agile Auditing Journey: Panel Discussion

• Vickie Chinchar, VP – Global Audit Services

Walmart

• Margaret Gray, Director – Corporate Audit, Agile Center of Excellence

Fidelity Investments

• Ranjani Narayanan, Co-leader of Agile Initiative and Senior Manager

Deloitte
Participant Q&A
 Thank You

The Institute of Internal Auditors

Rick Wright
Director, Internal Audit & ERM
YRC Worldwide, Inc.
[email protected]