Agile Revision

Agility as a conceptual basis for modern working methods helps teams and organisations to react flexibly and efficiently to changing conditions and (customer) requirements. This is because it provides answers to key questions that traditional project management methods struggle with. These answers can also be applied to the challenges faced by internal auditing.

Changing forecasts have often established themselves in controlling as a management tool as opposed to rigid budgets and target/actual comparisons. Against this background, it seems appropriate for internal audit to consider whether annual audit planning is still appropriate for a dynamic environment. Although the process of risk-oriented audit planning, i.e. the structured analysis of risk areas, potential weaknesses and available resources, is still an important means of coordination and communication between the stakeholders of internal auditing, the output of this process, namely the audit plan as such, with a built-in "buffer" for ad hoc issues, is demand-orientated and must be constantly adapted. Complex and rigid planning should therefore take a back seat in favour of continuous and flexible coordination of relevant topics. The same applies to the planning and implementation of individual audits.

In principle, the sustainable improvement of the first line of defence with its organisational and procedural measures for managing risks should be the goal of every organisation. An audit is not always the appropriate approach for this. One reason for this is that auditing regularly brings an elaborate, findings-orientated process of solutions identified in the meantime to a formal conclusion in report form. In contrast, an agile approach looks for opportunities to identify weaknesses unbureaucratically together with the department concerned and to implement suitable measures in a needs-orientated and, above all, rapid manner. One conceivable approach for the audit would be to carry out a brief "readiness check" in advance in order to possibly not even initiate audit activities based on the findings. In this way, audit reports could be prepared regularly after the elimination of identified weaknesses without significant findings in the interests of an effective first line of defence.  

Agile approaches deliberately rely on autonomous, interdisciplinary teams as key drivers for change and optimised results. Taking into account the aforementioned importance of improving the first line of defence, this raises questions about the composition of audit teams. As part of the readiness check phase and the subsequent implementation of measures, it seems sensible to rely on agile teams whose members are made up of the affected specialist departments, the audit department and possibly other specialist departments. Goal-orientated work in time-limited intervals, as used in Scrum, for example, not only promises efficient work and effective results, but also a positive working environment. Destructive "finger-pointing" or imposed recommendations can be counteracted in this way.

Agile working - for example according to Scrum - aims to constantly scrutinise one's own work results and methods and compare them with given requirements. This should enable the organisation to identify errors at an early stage, learn continuously and implement changes quickly. The aim of internal auditing should therefore not only be to enable the organisation as a whole to quickly draw the necessary conclusions from errors and weaknesses, but also to adopt this way of thinking for its own working methods.

On the one hand, internal audit is now forced to adapt to the increasing volatility of the audit subject matter and environment, while on the other hand it is under growing pressure to utilise the effectiveness and efficiency benefits resulting from agile ways of thinking for its own way of working. Those who do not embrace this development not only miss the opportunity to reposition themselves within the organisation, they also run the risk of increasingly losing relevance. Agile auditing offers the opportunity to gain relevance within the organisation and to better meet the demands of stakeholders.