Raven Catlin - Agile Auditing

We pioneered Agile auditing, assuming that audit clients wanted to build relationships with auditors and vice versa. We also believed that audit clients wanted to learn more about the why and how of audit processes. Again, we were wrong; well, we already knew this was wrong, but it was wishful thinking!

Why would we develop a framework with these assumptions? Because, based on our audit experiences until that time, those assumptions reflected how each of the 15 organizations we had worked with approached auditing. Additionally, it is how countless training clients wanted to approach their audits. Auditing practices learned throughout our audit careers have heavily influenced our Agile audit framework, including an emphasis on risk‐based auditing, Participatory Auditing, operational auditing, and relationship building. Our desire to overcome problems experienced in the audit process ultimately drives the Agile audit framework. We continue to adapt, champion, and encourage the implementation of an Agile auditing framework or methodology. Not every audit team may be able to implement a methodology exactly how a creator designed it. That is okay. We are giving you options for implementation in a framework, should you adopt Agile auditing. Using this framework and adapting it to fit your organization based on your cultures, experiences, governance practices, mindsets, client expectations, client interactions, and audit resources will lead to faster, better, and value‐added auditing.

We implore you to identify your assumptions. If you share the assumptions, you are well on your way to making Agile work for you. Should you find any assumption that doesn't fit for your organization, adapt Agile auditing to work for you. Every audit team can implement some Agile audit framework elements and recognize significant benefits when transforming to an Agile mindset. The most common benefits realized include more value‐add, more risk coverage, satisfied audit clients, increased confidence in audit results, streamlined audit practices, and happier auditors.

Adults learn through personal experience and the experiences and mistakes of others. We hope you learn from this book and the stories we share. As we've stated, our first several versions of our Agile audit framework weren't perfect. We made some mistakes, a concept accepted and promoted as a necessity to be Agile. We mentioned this earlier, but it needs emphasis: Agile is not about perfection. It is not about getting it right every time. Agile expects mistakes and errors, but you must identify and respond to the mistakes early and learn from them. We tried to help two organizations and a state government audit department implement Agile auditing without understanding what was necessary from an organizational and foundational standpoint. We learned about two essential fundamentals for Agile auditing success during those three attempts – the right culture and the proper communication. Chapter 17: Preparing Your Organization for Agile Auditing/Creating the Agile Culture is dedicated to these fundamental topics.

The ideas and stories presented in this book represent a collection of classroom, conference, and hands‐on work experiences and client interactions that began in 2011. We thank our clients and students for helping us evolve our once‐rigid Agile audit methodology into the flexible Agile auditing framework it is today. We continually adapt our Agile auditing journey and framework in response to new knowledge and an ever‐changing environment. This adaptation follows a fundamental Agile principle's expectations: as your knowledge increases, your needs change.

There is still more to learn. We read books, blogs, and white papers on Agile for different disciplines, frameworks, and industries. Classroom interactions challenge us to examine, reevaluate, and improve the Agile audit framework. Nearly every class we teach creates a new idea for Agile auditing. We recognize that Agile auditing is not perfect for every organization or every audit. As you start your Agile auditing journey, remember:

Your organization's Agile audit methodology must reflect your environment, culture, and audit practices.

Agile auditing is not a one‐size‐fits‐all methodology.

Even after your Agile auditing methodology and process is mature, look for continuous improvement opportunities, and adapt to your organization's constantly changing needs.

Perfection is a myth. Agile allows for failures, mistakes, and errors.

The Agile audit framework described in this book incorporates project management practices, Agile practices, Participatory Auditing, and end‐to‐end risk‐based auditing. Agile auditing begins with creating the audit plan by selecting audits of areas that pose the most significant risks to the organization and ends with communicating the results of an individual engagement based on which risks are not mitigated to an acceptable level; that is what we mean by “end‐to‐end risk‐based auditing.” We recommend using a holistic, risk‐based view of the audit process, even though you may elect to start with one piece of the audit process as you roll out your Agile audit methodology.

In this book, you'll find information about various organizations' Agile audit methodologies, attempts, failures, and successes to help you implement Agile auditing. Most importantly, you will gain knowledge to help you determine the right Agile auditing approach for your organization.

At the end of each chapter, we share “nuggets,” which are key takeaways, ideas, questions, suggestions, “aha moments” when the lightbulb comes on, and thoughts presented in the chapter. We want you to reflect on the content at the end of each chapter and encourage you to identify your nuggets.

Part I: Building an Understanding of Agile and Auditing acclimates the reader to Agile and auditing and consists of the following six chapters:

In Chapter 1: What Is Agile? , you will build an understanding of Agile and Agile project management so you are able to explain Agile to others. This chapter includes defining Agile and presenting the Agile Manifesto and its 12 principles. You will be introduced to the multiple frameworks under the Agile umbrella, including Scrum, the most popular framework, Scrum values, Scrum's three roles, three Artifacts, and five activities. You may even gain a thirst to obtain one of the Scrum certifications. You will also learn about using “recipes” for your Agile audit journey and explain how you can use the recipes provided in this book. You will find the Agile Manifesto, Agile frameworks, and recipe concepts to create your Agile methodology.

In Chapter 2 : What Is Audit? , you will learn how to define an audit, describe the different types of audits, and list the professional standards for the different types of audits. This chapter clarifies the audit project life cycle activities and use of audit customers and audit stakeholders. You will obtain brief overviews of auditors' key knowledge areas, including governance, risk, control, finance/accounting, technology, and compliance and skills needed as a successful auditor. The brevity of the discussion of the knowledge and skills is necessary, as each can be a separate book. After reading this chapter, you will be able to explain auditing, audit customers, knowledge and skills needed to be an effective auditor, traditional audit project life cycle phases, and problems encountered in the audit process that contribute to delivery risks to interested parties. This chapter includes a recipe for building auditor knowledge and skills.

In Chapter 3 : Traditional Audit Engagement Process and Practices , you will obtain information on tasks and activities in the traditional audit life cycle. Many of these activities were collected from work experiences and reviews of other audit methodologies and represent typical audit practices. Your specific traditional audit practices may vary, but you should see some similarities as well. This chapter helps you further understand the typical activities to complete audits in the traditional waterfall process and can be used to benchmark your current auditing practices. You will likely see the bottlenecks, redundancies, and inefficiencies created in the audit process and think of your Agile solutions as you read this chapter.