#AgileAuditing is a mystery to many, a dream to others, and reality to some. In 2013, Cecilia, a dear friend and fellow speaker, and I were venting over frustrations experienced in the life cycle of an audit. If you have audited for any length of time, you've been there: planning that takes forever, audit programs that don't focus on risks, delayed responses from audit clients, delays in getting requested evidence, workpaper reviews that are too vague or too late, debates on issue ratings, etc. You see, Cecilia is a veteran internal audit who believes education is the spice of life (along with salsa, which she makes the best!). Cecilia is also a CIA, CRMA, PMP, CGAP, and CISA and has a Masters in Risk Management. It was her experience with Project Management and her PMP that introduced me to Agile Project Management. She started explaining some of the things she was doing in her state agency that were Agile-ish and I was caught. I started researching #Agile and reading any literature I could find. I made a list of all my complaints and quirks about auditing and less than 1 year later, I presented my first training session on Agile Auditing.
Admittedly, that first session was very technical and theoretical because I hadn't yet had the opportunity to work hands-on with Agile in the Internal Audit space. There are some things about technical Agile that are difficult to accomplish, but not impossible. There are other aspects about Agile that could impair independence and / or objectivity. I am grateful for in-class participants and clients who, through the years, have trusted me enough to help them understand how Agile Audit can, and does work in practice. Class and conference interest and audiences have grown and Agile Auditing is finally taking off.
Since 2014, I worked with dozens of companies and interviewed at least a dozen more who are somewhere in their #AgileAudit journey. Yes, it is definitely a journey and everyone must start somewhere. My first attempt at implementing Agile Auditing failed, largely due to my ignorance of the importance of a supporting #CorporateCulture. You need to understand that Agile Auditing requires audit client engagement and at that company, Internal Audit was barely tolerated. It was that experience that made me realize that while #InternalAudit may be ready to be Agile, our audit clients may not be ready. The original design I created to do Agile Auditing didn't work without a supportive culture.
For a year or more, I shifted focus towards why our audit clients need Agile Auditing, the benefits the company would receive, and how to persuade executives that this approach is the right approach. My presentations shifted from being a technical how to implement agile internal auditing to the value of being agile. Many other presenters talk about the #AgileMindset and the attributes and behaviors of being agile. This is a great starting point for the necessary, persuasive-type presentations that many companies need.
The approach we have now is more adaptive, just as agile is meant to be. Our courses still help participants understand core agile theory, but also explores the entity so the Agile Audit Methodology may be adapted to the entity. So, the answer to "Can Internal Audit be Agile?" is....
ABSOLUTELY!