“Two-thirds of the Earth’s surface is covered with water. The other third is covered with auditors from headquarters.” – Norman Ralph Augustine
Sarcasm is also an intent in mentioning the above quote and at the same time, it is to showcase the wide presence of auditors in today’s corporate world who are primarily responsible for ensuring ‘everything essential’ to drive the business. Auditors ensure compliance with standards and are essential to different businesses and their aspects to ensure the deployment of best practices by organizations.
Agile auditing would be – Continuous planning, Continuous on-the-field work, Continuous Reporting & Continuous Follow-ups.
Everything continuous will create the traits of just enough planning, continuous retrospective to know ways of improvement, failing faster, and above all, moving away from a reactive approach to a responsive mindset.
We will attempt to answer the following frequently asked questions on agile auditing in this blog:
What is agile auditing?
How to design an agile audit methodology for your organization?
What are agile auditing techniques?
How to do agile audit planning?
What does agile audit mean?
How relevant is agile in the audit process?
What are some examples of agile auditing?
What is agile auditing?
Agile auditing is the term used to describe the usage of agility in auditing which implies the change in the current ways of conduct in today’s continuously changing work environment which leads to rapidly shifting business needs, evolving technology, expanding competitor’s base, complexity of compliance & security aspects and also gig-economy.
The software industry benefited from known approaches like Scrum & Kanban as they helped them imbibe the practices that let them fail faster by shortening the feedback loop and doing things incrementally which in turn helped them validate their current practices & then make a decision to either persevere, pivot or decommission.
The nature of the current and future business environment necessitates designing a focused agile audit methodology which will help auditors in embracing evolving risks and fulfilling their tasks of reviewing the current state and forecasting the strengths and weaknesses of the targeted area of audit. Agile audits can be spread across industries and can also be categorized as internal and external, across various focus areas like financial, tax, operational, compliance, IT systems, etc.
What is agile auditing used for?
Agile auditing methodology could benefit in resolving various changes that we see developing over time in how business environments are evolving worldwide. We are capturing some of the changes below:
Reactive vs Responsive mindset: It has been experienced that during an audit the target group is under stress as they will be scrutinized by auditors who will be dwelling on data that could be many months old which is not easy to fetch or can be justified with proper reasoning. Also, it leads to the manipulation of data and hiding of information which is not right for the higher purpose which is ‘improvement’.
Serving over Policing approach: Auditors can partner with their target groups and help them with suggestions and course corrections continuously instead of submitting their one-off full and final report which could lead to embarrassment and cause sourness in the system.
Being relevant over prescriptive approach: In this continuously evolving world, the tools and practices applied are changing and this also requires a new pair of lenses to audit. The idea is to adhere to standards that could be achieved in many ways and shouldn’t be limited to a way that auditors only know. Both auditors and their target group can brainstorm and identify the best tools and practices that can still give a chance to innovate without compromising the sanctity of excellence and standards.
Being immersive rather than detached: Auditors should collaborate with a target group with the intention of common shared goals as it is not the case at many places today. The POCs at target groups often find it difficult to adjust to changes in their constraints of scope, cost, time, etc which is important for business continuity and auditors must guide them to find ways to marry both constraints and excellence.
Agile auditing examples
The classic example could be reviews of project management, software development, data privacy, and security. This all could be termed as an ‘IT Audit’. There are several kinds of IT audits, each with different focuses and goals. Some of these include security audits, compliance audits, operational audits, IT governance audits, and software development audits. The specific type of audit conducted will depend on the needs of the organization being examined. Organizations may choose to conduct IT audits for a variety of reasons, including the following:
To ensure that information systems are being used effectively and efficiently.
To detect potential security vulnerabilities.
To identify compliance risks.
To assess the impact of new technology initiatives.
To evaluate the effectiveness of IT governance processes.
To make all the above forms contextual, the following agile auditing techniques or agile audit methodology needs to be practiced:
Clearly defined goals and objectives of the audit should be translated into incremental goals that can be achieved through back-to-back iterations of size 2-3 weeks called sprints
The emphasis should be on identifying the high value & high-risk impact so that those could be quickly identified and addressed instead of following the one-off approach and then segregating in the order of priority
The collaboration should be transparent and hence a Kanban board is a must-have to pursue the backlog of items and know their status. Everyone should collaborate using the same board. Even the reports should be automated to track progress
Frequent connects should be encouraged between all stakeholders and using the scrum framework will make it happen in short, continuous, quicker intervals
To assess the implementation of new technological vulnerabilities, we should form a team of Auditors specialized in Infosec & Data Privacy, Tech Architects & Engineers.
Skip to content 
