top of page

What is Agile Internal Auditing

There have been many discussions about agile auditing.

What agile internal auditing is about?

In a publication, it is stated that agile internal auditing is the use of agile software development values, principles, frameworks, methods, and/or practices in the execution of internal audit engagements.

By this, agile in internal auditing could be in use of agile software development values, use of agile principles, use of agile frameworks, use of agile methods or simply agile practices in the execution of internal auditing.

Scrum & Sprints

By definition from Merriam-Webster, agile is (i) marked by ready ability to move with quick easy grace, and (ii) having a quick resourceful and adaptable character.

In internal auditing, we followed an approach that constitutes of planning, fieldwork, review, and reporting. So, what does agile internal auditing mean? Does it mean we skip one of the steps which all are important to the quality of work? Not necessarily so.

Many organizations use the sprint and scrum in implementing their agile internal auditing. Scrum is one of the framework/methodologies often used in agile methodology, and a sprint is part of scrum's framework structure. Scrum gives meetings, tools, and roles, while a sprint is a defined period for creating a feature. The Scrum methodology is characterized by short phases or “sprints” when project work occurs. During sprint planning, the project team identifies a small part of the scope to be completed during the upcoming sprint. Therefore, the planning – fieldwork – review – reporting process still took place, but in a shorter time (sprint), and the audit is managed in a project management framework that are using agile philosophy. At the end of the sprint, work should be ready to be delivered to the client (user of internal audit report). Finally, the sprint ends with a sprint review and retrospective, point of view or lessons learned. This sequence is repeated throughout the project lifecycle until the entirety of the scope has been delivered.

Will it sacrifice quality? Again, not necessarily – if the client can agree to a small scope for each sprint as scrum is broken down into shorter sprints and smaller deliverables.

It is important to remember that although scrum is an agile approach, agile does not always mean scrum, there are many different methodologies that take an agile approach to project management.

It’s a Mindset

In short, it is a change in mindset on how the audit should be done. It is not on use of technological tools that make you agile, although the use of technology can add value to your agile approach.

It is more on being adaptive and responsive to what is found during the work – which could change the course of planned audit work as issues emerge and entail a faster audit work so that information can be deliver faster to create improvement needed.

Many organizations have already adopted an agile approach in their project management and product development (i.e., in large banks), so it is sensibly that internal audit can do that as well. However as said, it entails more fast approach from the internal audit team, it involves scrum in audit work – retrospective in each sprint instead of at the end of audit.

Since it is a change of mindset, transition might need a push from the top as the ultimate stakeholder of the internal audit function output. If the directive is clear from the board that it is what they want and need, then it would be easier to drive the change.


bottom of page