Agile auditing – why it is more important now than ever

October 2021 | SPOTLIGHT | ACCOUNTING & FINANCE

Financier Worldwide Magazine

October 2021 Issue

Coronavirus (COVID-19) has affected virtually every aspect of business in some way – and internal audit is certainly no exception. One of the key changes in the mindset of internal auditors over the last year and a half has been the increased call to action for companies to be more adaptive. So, it is not surprising that we have seen an increase in agile auditing since the start of the pandemic.

Agile starts with a shift in mindset and adoption of principles

Agile auditing, with its roots and principles founded in software development over 20 years ago, is focused on adaptability and collaboration. At its core, agile is the ability to create and respond to change. It is a way of dealing with, and ultimately succeeding in, an uncertain and turbulent environment. The authors (software practitioners) of the ‘agile manifesto’ chose ‘agile’ as the concept’s label because the word represented the adaptiveness and responsiveness to change that was essential to their approach.

In internal audit, agile encompasses culture, risk assessment, audit execution and reporting. It is about adopting a people-centric culture that operates in rapid learning, flexible planning and execution, and fast decision cycles enabled by technology and a common purpose to add value to stakeholders.

For example, internal audit departments typically perform a risk assessment once or twice a year and consider updating the internal audit plan periodically, usually in a reactive manner. In applying agile principles, internal audit organisations may perform a risk assessment each quarter with a shorter internal audit plan, identifying a backlog of audits to perform during the year and a list of emerging risks and watchlist audits that may find its way to the plan at any given point of the year. Success is driven by staying in constant communication with employees and stakeholders and by remaining adaptable to changing risks throughout the year.

As we examine the pandemic ramifications from a business standpoint, we see many companies changing their operations to become more digital and adapt to their team members working from home. New risks and opportunities are coming as fast as ever and therefore internal audit, to remain relevant, should proactively stay ahead of the risks and changes while adding insight and assurance to critical processes.

Of course, the last 18 months have not been an easy time to adopt agile principles because project management frameworks that support agile were largely built around in-person interaction – auditors together, in the same room, utilising a taskboard, for example, to implement a ‘scrum’ and track ‘sprints’, which are short time-boxed iterations of work to be completed by the team.

However, with circumstances not allowing that setup at the moment, auditors (and their technology) have been forced to evolve. They have shown agility, you could say, to adopt improved, more flexible principles as part of the switch to a work from home environment.

In fact, that willingness to evolve is one of the key building blocks of agile auditing. First and foremost, a company must have a culture that is receptive to change and capable of adapting to surprises. The pandemic, of course, has been a surprise unlike any of us had ever seen. It is impossible for an organisation to embrace change unless it changes its mindset first. And a willingness to change organisational mindset is directly tied to culture.

Certain companies can adapt easily. Others are fixed in their structure and approach. In either case, a corporate culture of adaptation, or one of rigidity, begins at the very top. The ones that adapt and change will be on the front line of information and innovation. The ones that are stuck in their ways will struggle to be proactive in identifying risks and adding value to their stakeholders.

Agile auditing: what we have learned

At a recent agile auditing roundtable with chief audit executives and internal audit leaders across a variety of industries, most of the participants noted that their companies have already adopted agile concepts to some degree. The challenge for most of these companies is accelerating from simply implementing adaptive audit aspects to incorporating agile approaches fully, in order to maximise all of the benefits.

The roundtable participants highlighted “faster identification of current and emerging risks and trends” as their number one challenge, speaking as internal auditors seeking to provide value to the organisation. This, of course, is right up agile’s alley, so to speak. Many of the participants are already incorporating agile principles, particularly in fieldwork and reporting – and also by investing in data analytics – as they strive to quickly identify emerging risks and trends.

One participating internal auditor noted: “Sometimes I would feel concerned when we planned our audits a year or more in advance. With a rolling quarterly audit plan, it allows us to assess risk more frequently and gives us the flexibility to change the audit if needed.”

In summary of the overall dialogue (including best practices, tips and challenges), organisations are encouraged to prioritise the following three agile auditing recommendations. First, develop an internal audit brand of ‘being agile’ by doing what you say you are going to do. It is a matter of actions, rather than words. That is what builds your reputation and what makes a tangible difference in your organisation, both internally and externally. Second, continually reprioritise and focus investing in continuous monitoring and use of the business data and reporting capabilities within internal audit to stay on top of change and new developments. Finally, implementing agile project management methods is not one size fits all, so immerse your team in learning about agile frameworks and methods. Conduct pilot audits if you are new to agile and capture lessons learned. If you are experienced with agile auditing, understand that different types of audits, dynamics in team experience, and preferences of business owner values require a shift in the use of frameworks and the modification of how you conduct your audit execution and reporting.

Risks in real-time: the ultimate benefits of agile auditing

The three primary benefits of agile auditing are generally considered to be: (i) better team collaboration; (ii) faster reporting; and (iii) an ability to adapt faster throughout the audit. All of these boil down to the ultimate benefits: identifying risks in real time and providing assurance and insights faster and when they are more relevant. After all, the faster your organisation can identify potential risks, the faster it can begin to prepare for challenges and develop solutions.

Related to that, the ability to identify risks in real-time comes when you communicate consistently with employees who have boots on the ground, as well as other key stakeholders and executives. Rather than having a reactive mindset, which companies are trying to get away from, you can now have a proactive mindset by quickly identifying risks because you are receiving early information and consistent feedback. With an agile mindset, key stakeholders, executives and audit committees will always be up to date on emerging issues and will always know what they do not know – if that makes sense – because that is really what risk identification and risk response is all about.

Looking to the future

In summary, more companies are adopting an agile auditing mindset – which we commonly referred to as agile with a little ‘a’ – as they aim to provide value by identifying risks faster and ensuring a more timely response to those risks. Those organisations that are adopting agile auditing with a big ‘A’ are devoting the time and resources to implementing agile principles and project management methods, adapting their organisational structure and culture and modifying the internal audit approaches with what fits their needs and maximises value. There will continue to be challenges to fully adopting agile related to regulatory requirements, time and resource constraints and the inherent aversion to change, but the benefits of going all-in on agile are particularly clear.

The pandemic, if nothing else, is accelerating the need for an agile mindset in auditing (and all walks of life, for that matter). As in the spirit of agile, an internal audit organisation can start now by setting short-term goals for agile audit implementation over the next few months, monitor the improvements, learn from failures and adapt to the risks and the unknowns that the pandemic will continue to bring. By doing so, your internal audit organisation will continue to remain relevant, valuable and agile.

John Romano is a partner at Baker Tilly. He can be contacted on +1 (215) 972 2277 or by email: john.romano@bakertilly.com.

John Romano

Baker Tilly