What Is Auditing with Agility?
Check out my post from the IT Revolution's blog, which includes another sneak peek of my upcoming book, Beyond Agile Auditing!
Clarissa Lucas
This post has been adapted from the Introduction to Beyond Agile Auditing: Three Practices to Revolutionize Your Internal Auditing Practices by Clarissa Lucas, coming in May 2023.
Auditing with Agility moves beyond strict auditing frameworks and truly empowers teams to add the most value possible through a flexible, customizable approach to auditing. It enables teams to experience the benefits of an efficient and value-added audit, while cultivating and leveraging a strong partnership between clients and auditors.
Goals of Auditing with Agility
The goals of Auditing with Agility include those of traditional waterfall auditing (to help the organization achieve its objectives by providing value through assurance and insights) and Agile Auditing (to increase efficiency in the audit process). In addition to these goals, Auditing with Agility strives to deliver even greater value through prioritizing work based on value to the organization, responding to change, delivering results timely, and focusing on outcomes.
We can all agree, regardless of whether you’re a client or an auditor, that an audit focused on the processes, products, and risks that are absolutely crucial for the organization to achieve its objectives is more valuable than an audit focused on processes, products, and risks that have relatively little impact on the organization. We can also recognize that real-time feedback is more valuable than stale feedback delivered months after identifying a problem. Finally, I’m confident we can agree that wasting time is…well…a waste of time and not valuable to anyone. By that logic, it’s clear that our organizations need to revolutionize the way they conduct and deliver internal audits. That is the intent of Auditing with Agility.
Three Core Components of Auditing with Agility
Auditing with Agility consists of three core components. By focusing how you work on these three components and your desired outcome instead of on a strict framework, you can be assured of a smooth, helpful, empowering audit instead of a dreaded exercise in bureaucracy.
The three core components are
- value-driven auditing
- integrated auditing
- adaptable auditing
Let’s look at each of these in more detail.
Value-Driven Auditing
To be value-driven, the scope of audit work must be driven by what adds the most value to your organization. Each organization may define value differently. Delivery of value in terms of an audit could be assurance and insights in the areas of greatest risk or greatest opportunity for the organization. To help you determine how your organization and its key stakeholders define value, work with your organization’s key stakeholders to understand what they value and how you can align audit work with that definition of value.
Key outcomes associated with value-driven auditing include greater alignment between audit work and the organization’s priorities, expedited delivery of value, and elevated awareness and ability to respond to risks.
Chapter 5 of the book Beyond Agile Auditing details ways to put this principle into practice. As an appetizer, consider this: delivering results in iterations or sprints is a way to deliver value early and often. Decomposing the audit scope into areas of focus and prioritizing these areas of focus lets value drive the audit’s scope.
Measuring progress primarily through delivery of value further facilitates and incentivizes value-driven auditing. If your primary measure of progress is delivery of value, then your team will more likely be motivated to deliver value than they would if something else (like the number of audit reports delivered) was the primary measure of progress.
Another way to evolve to more value-driven auditing is through increasing the visibility of audit work. Making invisible work visible helps the team ensure they’re working on tasks that create value. Without visibility of all the work each auditor performs, auditors may spend their time on work that does not result in or contribute to value for the client or the organization.
When the work is visible, other team members can question the value of the work to be completed (not in a malicious sense, but in a way that helps educate themselves or to ensure proper investment of the team’s time). If the tasks in question do not add value, then the team can pivot to other tasks that do provide value.
This is closely related to constantly optimizing for global goals, which also supports value-driven work. Global goals for the audit assist in achieving the organization’s global goals. By continuously evaluating the team’s work to ensure it aligns with global goals, you ensure your team’s work provides value to the organization.
Integrated Auditing
Prior to the introduction of integrated auditing, audits were focused primarily on a single aspect, such as financial reporting. In 2012, the Institute of Internal Auditors (IIA) published guidance explaining the next evolution in internal auditing (at the time) was integrated auditing. The IIA defined integrated auditing at that time as an audit with greater breadth in coverage beyond a singular aspect. Integrated auditing included multiple aspects of a process, such as financial, operational, compliance, and technology. By moving to this type of integrated audits, organizations experienced “a more effective and efficient audit engagement,” “increased relevance” of audit work, “increased coverage, improved reporting and more effective risk assessments and audit planning,” as well as a more holistic view of the risk and control environment under review.
What the guidance doesn’t discuss is integrating audit work with the client’s work. Without this level of integration, organizations miss out on an opportunity to further increase efficiency and effectiveness. Audits are still viewed as additional, unplanned work, which hinders audit clients from achieving their primary objectives, setting the foundation for a combative or adversarial relationship.
The concept of taking the next leap in the integrated auditing journey is one of the things that sets Auditing with Agility apart from other practices or hot topics in the auditing industry. Here is where we challenge the perceived boundaries that have historically separated auditors from clients and, in some organizations, driven a wedge between these two groups.
If you’re looking to take your audit experience to a new level and set yourself apart from your peers, perhaps you’ll want to further your integrated auditing progress by looking beyond integration within the audit organization to the possibility of integrating with the client and the client’s work, while maintaining the required independence. When auditors and clients work together daily, they take a step closer to integrating their work. For example, working together when determining the audit’s scope integrates the client into the audit, giving the client a voice and creating stronger buy-in.
In many situations, auditors cannot successfully complete an audit without the client’s help. The client provides insights into the processes under review, including the relevant risks. The client also fulfills evidence requests so the auditors can complete their testing. Therefore, it makes more sense for auditors and clients to work together rather than against each other in order to get the most out of an audit.
While I am suggesting that auditors and their clients should work closely together and think of themselves as one team during the audit, I’m not suggesting that reporting structures change. Auditors still need to maintain independence and objectivity. Balancing increased integration with independence and objectivity is imperative to the success of a more integrated audit. Chapter 9 explores this balance in greater detail.
Integrated auditing, as part of Auditing with Agility, encourages auditors to find ways to integrate audit work with the client’s work. For example, if the client conducts daily stand-ups (or other similar meetings with a different frequency), suggest that the audit team join in on those meetings to
- (1) better understand the client’s priorities and daily work and
- (2) discuss matters related to the audit, such as open requests and quick questions to clarify the auditors’ understanding. This reduces audit-related interruptions to the client’s work and decreases or eliminates excessive meetings.
Another way of integrating these two historically segregated types of work is through real-time feedback loops. Real-time feedback doesn’t wait until a specified time for feedback. Instead, feedback is provided immediately. In theory, this is fairly intuitive and seems easy. In reality, it takes a safe environment to facilitate effective real-time feedback loops. By integrating auditors and the client, an organization can cultivate a safe environment, which facilitates real-time feedback loops. This, in turn, leads to closer working relationships between auditors and clients, thus reinforcing integration between the two groups.
Integrated auditing also means integrating continuous improvement into the audit process. Insights on how to integrate continuous improvement into your audit process by reflecting on how to become more effective and adjusting behavior accordingly are further explored in Chapter 6 of Beyond Agile Auditing.
Adaptable Auditing
Adaptable auditing focuses on improving the ability to respond to change and adding flexibility into the audit process. It is a mindset and a way of working rather than a framework to implement. If your organization has prioritized increasing delivery of value through incorporating adaptability into audit work, you’re in luck! What’s even better is if your organization hasn’t mandated a specific methodology (e.g., Agile Auditing) to achieve this goal. If this is the case, you have the flexibility to be truly agile in your approach to Auditing with Agility. (And this book provides you with the knowledge you need to bring that to life!)
Chapter 7 of Beyond Agile Auditing includes a number of practices you can use to incorporate adaptable auditing. Many of them are derived from the Agile principles of software development, which I’ve translated into principles of Auditing with Agility. If you’re interested in learning more about the Agile Principles, check out the Appendix.
Leveraging self-organizing teams, which encourages high levels of collaboration, is a way to add adaptability to auditing. In the context of an audit, strong collaboration may look like all of the auditors attending working sessions or walkthroughs, regardless of the control test they’re currently working on. This way of working disseminates and shares knowledge among the team members, which better positions the team to pivot when a change is necessary. For example, if a team member is unexpectedly out of the office or unable to complete work on the audit, their teammates can pick up the work left behind without the need for a knowledge-transfer session.
Another principle of adaptable auditing is to embrace changes, even if they occur late in the audit process. If something during the course of the audit necessitates change, the auditor’s ability to change course accordingly is imperative. Looking at this from a different perspective, failing to change course when necessary may reduce the value of audit results.
During the onset of the COVID-19 pandemic, my team was performing audits in two key areas of the organization that were heavily involved in the organization’s response to the pandemic. (To be fair, nearly every part of the organization was impacted in one way or another by the pandemic. Some parts of the organization were more involved in driving the organization’s response to the pandemic and others proactively took measures to ensure the organization’s success in its response. The two areas under review during the audit were examples of the latter.) Had we continued to conduct these audits without pausing to consider a change to our scope or approach, we would have impeded the organization’s successful response to the pandemic.
Instead, we briefly paused, listened to our clients to understand how they were impacted, including the impact to their availability, and changed our approach accordingly. We continued conducting the audits, but we proceeded with additional empathy for our clients and increased flexibility when scheduling meetings or requesting information. We found ways to fulfill requests on our own and become as efficient as possible with our clients’ time. Doing so enabled us to continue to provide assurance in these areas that were now more in the spotlight than ever before, without getting in our clients’ way.
Some of the practices within the Agile Auditing framework align with adaptable auditing. Stand-ups, for example, enable audit teams to shift available resources to tasks that need attention and to change testing procedures as needed to reflect the latest information the audit team has. Further, limiting work in process creates the capability (or paves the way) for teams to move with velocity and change course when necessary. When work is in process, it is more difficult to change course or transfer the work to someone else. By limiting work in process, there are small breaks in the work between when one item is completed and another begins. These breaks create natural opportunities to assess the audit’s direction and determine if the team needs to change course.
Benefits of Auditing with Agility
At its core, leveraging Auditing with Agility better positions your organization to achieve its objectives. Auditing with Agility also yields additional benefits, including the following outcomes:
- Stronger relationships between auditors and clients
- Increased employee engagement
- Delivery of value focused in areas of greatest risk and highest value to your organization
- Greater buy-in (from both clients and auditors)
- Increased ability to respond to change
- More timely communication of results (and value) to stakeholders
- Elevated awareness of and ability to address risk
- Reduction in time wasted
You can read even more details about the many benefits of Auditing with Agility as well as the practices and processes you can implement in Beyond Agile Auditing: Three Core Components to Revolutionize Your Internal Audit Practices by Clarissa Lucas. Coming from IT Revolution in May 2023.