Agile Auditing. Raven Catlin
incorporate our Agile audit framework. We love it even more when others challenge the framework, thoughts, practices, and methodologies. For example, in a 2015 class of 30 students, when we suggested that an audit team, even a team of one auditor, could complete an entire audit in a two‐week time frame one student called us “crazy.” We deliberately decided on a two‐week cycle to break the decades‐long auditing practices that created many of the problems encountered in nearly every audit. Others also felt that Agile auditing was vastly different from traditional auditing and would be “impossible” to implement. Each challenge resulted in a reevaluation of the framework and the creation of more choices in it. It's comical that the same “crazy” and “impossible” comments were made when Agile entered other disciplines. However, it has been fully adopted in many disciplines!
A few weeks after the 2015 class, it concerned us that others couldn't see the value in this approach to Agile auditing. Once again, we were back learning, thinking, and analyzing the framework, and we realized there was a problem. The problem was not necessarily with the Agile audit framework, but with audit approaches, perceptions, and assumptions, specifically:
Audits are supposed to be risk‐based; we pioneered Agile auditing, thinking that all auditors used a risk‐based approach. We were wrong.
We pioneered Agile auditing believing that all auditors already collaborated with audit clients to complete audit work. Again, we were wrong.
We assumed employees, auditors, and audit clients have a common goal: the organization's success. Unfortunately, there are many examples where the success of the organization is not a mutual goal.
We thought all auditors wanted and needed to feel liked by their coworkers. As much as we don't like to admit it, some auditors enjoy being feared and disliked by their coworkers even today.
We believed that if all employees understand the how and why of the audit process, audits can be improved.
We pioneered Agile auditing, assuming that audit clients wanted to build relationships with auditors and vice versa. We also believed that audit clients wanted to learn more about the why and how of audit processes. Again, we were wrong; well, we already knew this was wrong, but it was wishful thinking!
Why would we develop a framework with these assumptions? Because, based on our audit experiences until that time, those assumptions reflected how each of the 15 organizations we had worked with approached auditing. Additionally, it is how countless training clients wanted to approach their audits. Auditing practices learned throughout our audit careers have heavily influenced our Agile audit framework, including an emphasis on risk‐based auditing, Participatory Auditing, operational auditing, and relationship building. Our desire to overcome problems experienced in the audit process ultimately drives the Agile audit framework. We continue to adapt, champion, and encourage the implementation of an Agile auditing framework or methodology. Not every audit team may be able to implement a methodology exactly how a creator designed it. That is okay. We are giving you options for implementation in a framework, should you adopt Agile auditing. Using this framework and adapting it to fit your organization based on your cultures, experiences, governance practices, mindsets, client expectations, client interactions, and audit resources will lead to faster, better, and value‐added auditing.
We implore you to identify your assumptions. If you share the assumptions, you are well on your way to making Agile work for you. Should you find any assumption that doesn't fit for your organization, adapt Agile auditing to work for you. Every audit team can implement some Agile audit framework elements and recognize significant benefits when transforming to an Agile mindset. The most common benefits realized include more value‐add, more risk coverage, satisfied audit clients, increased confidence in audit results, streamlined audit practices, and happier auditors.
Adults learn through personal experience and the experiences and mistakes of others. We hope you learn from this book and the stories we share. As we've stated, our first several versions of our Agile audit framework weren't perfect. We made some mistakes, a concept accepted and promoted as a necessity to be Agile. We mentioned this earlier, but it needs emphasis: Agile is not about perfection. It is not about getting it right every time. Agile expects mistakes and errors, but you must identify and respond to the mistakes early and learn from them. We tried to help two organizations and a state government audit department implement Agile auditing without understanding what was necessary from an organizational and foundational standpoint. We learned about two essential fundamentals for Agile auditing success during those three attempts – the right culture and the proper communication. Chapter 17: Preparing Your Organization for Agile Auditing/Creating the Agile Culture is dedicated to these fundamental topics.
The ideas and stories presented in this book represent a collection of classroom, conference, and hands‐on work experiences and client interactions that began in 2011. We thank our clients and students for helping us evolve our once‐rigid Agile audit methodology into the flexible Agile auditing framework it is today. We continually adapt our Agile auditing journey and framework in response to new knowledge and an ever‐changing environment. This adaptation follows a fundamental Agile principle's expectations: as your knowledge increases, your needs change.
There is still more to learn. We read books, blogs, and white papers on Agile for different disciplines, frameworks, and industries. Classroom interactions challenge us to examine, reevaluate, and improve the Agile audit framework. Nearly every class we teach creates a new idea for Agile auditing. We recognize that Agile auditing is not perfect for every organization or every audit. As you start your Agile auditing journey, remember:
Your organization's Agile audit methodology must reflect your environment, culture, and audit practices.
Agile auditing is not a one‐size‐fits‐all methodology.
Even after your Agile auditing methodology and process is mature, look for continuous improvement opportunities, and adapt to your organization's constantly changing needs.
Perfection is a myth. Agile allows for failures, mistakes, and errors.
The Agile audit framework described in this book incorporates project management practices, Agile practices, Participatory Auditing, and end‐to‐end risk‐based auditing. Agile auditing begins with creating the audit plan by selecting audits of areas that pose the most significant risks to the organization and ends with communicating the results of an individual engagement based on which risks are not mitigated to an acceptable level; that is what we mean by “end‐to‐end risk‐based auditing.” We recommend using a holistic, risk‐based view of the audit process, even though you may elect to start with one piece of the audit process as you roll out your Agile audit methodology.
In this book, you'll find information about various organizations' Agile audit methodologies, attempts, failures, and successes to help you implement Agile auditing. Most importantly, you will gain knowledge to help you determine the right Agile auditing approach for your organization.
At the end of each chapter, we share “nuggets,” which are key takeaways, ideas, questions, suggestions, “aha moments” when the lightbulb comes on, and thoughts presented in the chapter. We want you to reflect on the content at the end of each chapter and encourage you to identify your nuggets.
Part I: Building an Understanding of Agile and Auditing acclimates the reader to Agile and auditing and consists of the following six chapters:
In Chapter 1: What Is Agile?, you will build an understanding of Agile and Agile project management so you are able to explain Agile to others. This chapter includes defining Agile and presenting the Agile Manifesto and its 12 principles. You will be introduced to the multiple frameworks under the Agile umbrella, including Scrum, the most popular framework, Scrum values, Scrum's three roles, three Artifacts, and five activities. You may even gain a thirst to obtain one of the Scrum certifications. You will also learn about using “recipes” for your Agile audit journey and explain how you can use the recipes provided in this book. You will find the Agile Manifesto, Agile frameworks, and recipe concepts