As traditional operating models were interrupted during COVID-19, organisations had to adapt quickly which created rapid changes to risk profiles. These changes demanded internal audit functions flex quickly and adopt scalable, flexible audit techniques and approaches. In demonstrating this new value offering, internal audit now has the opportunity to permanently shift the dial.
Internal audit functions had the opportunity to pivot to a more pragmatic and agile approach and with expected continued demand for more rapid, targeted and efficient assurance internal audit functions will need to provide enhanced insights and quick responses to changing risks and priorities.
Agile internal audit techniques allow for a timely and fit-for-purpose approach to providing assurance during uncertain and changing times.
Agile internal audits are founded on the agile project and change management methodology, built to accommodate continually changing circumstances. As the agile method is shorter and iterative it allows for more flexibility and delivers greater impact when new initiatives arise, or significant business interruption occurs. Agile approaches to delivering outputs are increasingly being used across all organisations, including second and third line functions.
Agile internal audit delivers reduced costs, efficient delivery and improved quality. Agile is based around the concepts of:
Agile assists in prioritising audits based on risk and the organisation’s readiness to perform the audit, with the delivered report focusing on providing insights and delivering briefer, timely feedback – with less words and, ideally, more visuals.
The adoption of agile creates an opportunity for internal audit to think differently about the delivery of audit plans and the critical controls monitoring in the longer term.
Internal audit professionals pivoting towards an agile delivery execution need to consider the changes needed to key audit concepts.
||Traditional Audit||Agile Audit
||Audit objectives||Defined value expectations|
|Ownership||Internal audit team||Collective, team based|
|Engagement Sequence||Linear||Sequential work cycles|
|Planning||Rigorously planned activities and a set master internal audit plan||Activities are quick, iterative (sprints) and incremental|
|Communication||Ad-hoc communication, typically during finalisation of fieldwork and reporting.||Frequent communications, for example daily meetings and auditees involved throughout.|
|Status updates||Ad hoc – as needed or as defined by organisations audit methodology.||Daily and incremental with input from the client and key stakeholders.|
|Reporting||One report, provided on completion of the audit, and often requiring a laborious review process.||Smaller ‘summaries’ provided throughout project with focus on value and visualisation.|
|Documentation/Working Papers||Significant, comprehensive and thorough to ensure work is defendable, often reviewed at completion of project.||Rationalised and value based. 80/20 rule – 20 percent accounts for 80 percent of results. Reviewed throughout project.|
|Auditee Relationship||Arm’s length||Collaborative relationship, with auditee ownership and agreement throughout.|
|Flexible and dynamic internal audit planning through continuous risk monitoring|
|Short iterations aid timely adjustments for the audit|
|Value creation by focusing on the (agile) resultIterative reporting|
|Continuous optimisation on the method by welcoming changes|
|Collaboration and multidisciplinary teams as a basis for added value|
Full scale internal audits that adequately address complex and high risk reviews will always be required. Internal audit teams will need to give careful consideration to the application of agile, ensuring the appropriate nature of the audit topic and the profile of participating auditees. There are some internal audit areas which may be best aligned to agile approaches.
Agile audit reports are brief, timely, and succinct. They are the culmination of observations which have already been shared and agreed with management, for which management have addressed or implemented actions. Key concepts include the following.
COVID-19 has provided the unusual opportunity for internal audit professionals to rapidly adopt and transform their traditional approach. Given the ongoing change and disruption which will continue in the wake of COVID-19, agile internal audit will be demanded as a sustained and long term assurance technique.
If you have any questions regarding the content of this article and would like speak to someone from our team please contact us.