Internal audit functions play a critical role in every organization by providing a timely response to evolving risks during periods of disruption and challenging environments. The COVID-19 pandemic has created disruption within organizations and internal audit functions, and poses unique challenges for organizations on how to work and respond to emerging risks at a rapid pace. For internal audit functions that have embraced an Agile Internal Audit (Agile IA) methodology or for those considering adopting Agile IA, this article highlights several potential benefits of utilizing Agile IA during a time of disruption, such as the COVID-19 pandemic.
What is Agile Internal Auditing
Agile is defined as the ability to create and respond to change. Agile IA is a methodology designed to enhance value and enable internal audit functions to be efficient, flexible and responsive to changing needs and priorities. The principles and values used for Agile IA are based on the “Agile Manifesto,” which was created by a group of software development leaders who were tired of the challenges and limitations of traditional methodologies1. The Agile Manifesto defines core principles and values that focus on “What” to do versus “How.”
Agile IA is an iterative approach that focuses on flexibility, collaboration and enhancing value. Additionally, Agile is a mindset that helps drive change in behavior and culture.
Traditional “Waterfall” Approach vs. Agile Internal Audit
Traditional internal audit follows a “waterfall” model where various activities are broken into linear phases. This method has worked for decades because the process is simple. As business environments adapt to urgent change, the waterfall model has revealed its shortcomings. Well-defined processes are not conducive to change as each phase of the audit is dependent on the previous being completed. Agile IA methodology assumes that change is inevitable and is inherently less rigid. The following graphic depicts the primary differences between a traditional waterfall approach and Agile IA:
Traditional “Waterfall” Internal Audit Methodology
- Simple process - broken into linear phases (Audit Planning, Fieldwork and Reporting)
- Focuses on audit objectives
- Not conducive to change; phases are dependent on the previous phase
- Accessing information causes bottlenecks
- Lack of stakeholder / auditee engagement during fieldwork
- Frequent disagreements on observation and potential recommendations between Audit and auditee
Agile Internal Audit Methodology
- Short iterations of work; allows for changing of course easier
- Focuses on the value of the work performed
- Quick risk responses and delivery of results
- Requires frequent points of communication
- Transparency of information; more involvement and trust
- Fosters trust and partnerships, resulting in fewer disagreements
Agile Internal Auditing Benefits
- Dynamic Ability to Shift Audit Focus during Crisis
During periods of disruption it is imperative that internal audit functions focus on value-add activities and high priority risks. Because Agile IA is based on short iterations of work, internal audit teams can change course easier and focus on value to the organization rather than low risk audit objectives with little overall impact. Shorter iterations also allow for quicker risk responses and delivery of results.
- Self-Organization and Empowerment
According to Agile Manifesto principles, Agile IA teams should be empowered and self-organized2. Traditionally, IA functions split their audit teams into functional areas, or silos, where each have their own area of responsibility. The approach in Agile IA is to develop a cross-function team with horizontal representation of the various functional areas, such as operations, finance, IT and compliance. Crossfunctional teams allow for continuous learning, ownership of work and empowerment. COVID-19 challenges how teams work, and each team member may not be able to contribute equally. Agile teams strive for everyone to know enough about each area to contribute, maintain a smooth workflow, and make better team decisions.
- Communication and Transparency
An additional benefit of Agile IA is increased stakeholder engagement through early and continuous delivery. To satisfy the stakeholder or auditee, a working agreement is established before the work starts, with key stakeholders from the business to promote participation and collaboration throughout the entire audit cycle. Within the working agreement, a shared vision of success (i.e. criteria), communication cadence and deliverables are defined to ensure alignment with stakeholders’ expectations. During a major disruption like COVID-19, Agile IA allows teams to virtually continue business as usual with minimal disruption.
- Continuous Improvement
Currently, the urgent adaptation required to maintain daily operations can be difficult for organizations that did not previously embrace creativity and innovation, such as implementing technologies to enable remote working conditions. COVID-19 is challenging teams to work against their usual business processes. Although working remote is not a new concept, the uncertainty of how and how long is unsettling. An Agile culture focuses on the process and not the outcome; therefore, it creates a safe environment for team members to take risks when trying new ways of operating to adapt to COVID-19. Focusing on the process allows teams to continuously evolve and improve through meaningful discussions of what does and does not work.
Internal Audit departments that have implemented an Agile methodology are benefiting from a culture of mental agility through its leadership and behavior. Agile IA methodologies support change more effectively and efficiently by creating an environment of continuous improvement, fostering selforganization and empowerment and providing enhanced transparency. For additional information on Agile IA, please contact firstname.lastname@example.org.