Takeaways from my recent readings

In this post, I am sharing some interesting takeaways from my recent readings. I will keep it very brief to enable you to go through it despite of your busy schedule! Of course, you can always download the original documents if you wish to learn more.

 Key Components of Digital Trust:

ISACA in a new free guide (Understanding the Six Key Components of Digital Trust| ISACA) defines digital trust as:

"Digital trust is confidence in the integrity of relationships among providers and consumers in a digital ecosystem."

The guide has identified six key components of the trust as follows:

• Quality of products and services
• Availability of information 24/7/365
• Security and Privacy
• Ethics and Integrity
• Transparency and honesty 
• Stability and Resilience

 Recession Playbook for Chief Audit Executives:

A Gartner 2022-2023 playbook identified the following 9 actions across three main areas that is believed to help in managing resources, being agile in securing talent, and accelerate digital and technological initiatives:

You can download the playbook by following this link:

Recession Playbook for Chief Audit Executives (gartner.com)

Turning Audit Clients into Allies

In its 2022 audit management playbook, AUDITBOARD offered some tips for turning audit clients into allies:

You can download a copy by following this link:

The Audit Management Playbook [2022 Updated] | AuditBoard

When Internal Audit Is Agile And The Audit Committee Is Not!

The traditional challenge for Internal Audit was in its ability to meet and/or exceed its stakeholders' growing expectations. While some Internal Audit functions may have suffered and failed to achieve this objective,  I would like to believe that most of the functions have been successful not only in meeting the expectations but also in taking the lead and initiative to introduce change and innovation and prove their relevance!

One of the buzzwords and trends nowadays is "agile internal auditing". Internal Audit functions around the world are working on understanding what it is about, exploring what it means to their operations and how to successfully implement it in their organizations. A successful implementation requires the buy-in and collaboration of stakeholders. You would think that management and the audit committees would be thrilled when Internal Audit starts the transformation process. That would be true in most cases, but sometimes there are forces within the Organization that resist change. When these forces are management, Internal Audit can seek the support of the audit committee to convince management. But, what if the audit committee is the resisting force? Imagine a situation where a CAE approaches the audit committee with  his/her plans to implement agile internal auditing and the answer he/she gets is:

• "This is a luxury we can't afford",
• "Stick with the audit plan, it works", 
• "This is not the time for a dramatic change", 
• "We don't have the resources and/or experience to do this", 
• " We will think about it",
• "What is agile internal auditing?"

Does this sound familiar? If you have heard any of the above responses, you are not alone! 

What comes to your mind when you hear such a response? You may conclude that Internal Audit did not do a good job communicating the concept and benefits of agile internal auditing to the audit committee. Perhaps they did not explain that it is more of a  mindset than a methodology, that it can be applied gradually, that it is not all or nothing approach or a one approach fits all solution. The reaction of the audit committee could indicate that there is a deeper disconnect with the audit committee! You may also conclude that the audit committee members don't possess the right mindset, vision, experience, or qualification to discharge their duties in these uncertain times! 

What will be your strategy to bridge the gap with the audit committee and initiate the transformation to agile internal auditing.? Please share your experience and thoughts. And remember to:

                                                               "be agile, be alive"!

Adapgility Consulting is your Internal Audit Partner and can help with the agility transformation process.

Picture source:www.hme-business.com

Are you the same person you were before the COVID-19 crisis?

Now that you have stayed at home and working remotely for some weeks, it may be time to ask how this life-changing experience has affected you at the personal and professional levels?

Are you the same person you were before the crisis?

What has changed in your perspective of life, family, and your profession?

When you return to your office, hopefully in the near future, what would you be doing differently? Will you be doing audit planning, risk assessment the same way you used to do? How will your relationships with the stakeholders be reshaped? And more importantly, how your understanding of your role as an internal auditor has changed or evolved?

If you believe this experience has not changed you, can you share why you feel this way and what contributed to your status quo?

Please share your thoughts!

picture credit:https://liveboldandbloom.com

How will Internal Audit look like after COVID-19?

There have been many articles and posts dealing with the Internal Audit's role during the COVID-19 crisis. These were useful, but now we need to plan for what happens next. The economic, social and financial implications of the crises are expected to be severe at least for the short term.

Eventually, this crisis will pass and most businesses will resume operations and will have to adapt to the new realities to survive. Changes to operations and mindset will need to be made at all levels including at Internal Audit Departments.

As most of you are at home during this difficult time and are probably bored, let's try to think about how the internal audit function at your organization will look like after the crises! For example:

• Did the crisis change you as a person and how this will reflect on you as an internal auditor?
• What lessons have you learned during the crises and what are you going to do about it?
• What type of changes will you make to strengthen internal audit?
• Do you anticipate an increase or decrease in the number of auditors within your department?
• Do you anticipate management to change its perspective of internal audit (positive or negative)?
• What would you do to be prepared for the next crisis?

I look forward to hearing your thoughts and feedback!

Should The IIA & ISACA merge?

In a joint IIA and ISACA press release back in 2010, the following statement was included to explain why the management of both organizations have met to discuss shared challenges and opportunities:

"Given the similar—but not same—nature of ISACA’s and The IIA’s professional areas, it is not surprising that the organizations have faced many of the same situations over the past several years." 

A decade later and while we acknowledge that there is a reasonable level of coordination between both organizations, one can not stop wondering if there is a need for both organizations to merge to better serve their members and customers!

Should the rapid change in professional roles, technology, disruption, risks and stakeholders' expectations justify a merger? There were indications throughout various surveys that CAE's are now more involved in the management of IT audits and that this trend is expected to continue in the future. Is this enough reason to start thinking about a merger?

I have raised the merger issue in several posts in the past but did not receive enough feedback! I hope we can now start a debate on this issue. I would love to hear the views of those who support and oppose such a merger!

These are my thoughts, please share yours.

 

What Exactly is An Agile Internal Audit?

Can Internal Auditing become Agile? Seven Keys to Thinking the Unthinkable.

 That was the title of a Forbes Article in 2017 written by Steve Denning the author of the book "The Age of Agile". Now that the unthinkable he referred to is becoming a reality for some internal audit functions and a wish list item for many functions around the world, I will in this post provide a simplified basic understanding of the agile concept for the benefit of those who are not yet familiar with it!

What is Agile?

According to the oxford dictionary, Agility means the “ability to move quickly and easily”. It is also defined as “the ability to think quickly and in an intelligent way” when it is referenced to the mindset.

Simply put, the agile methodology is a type of project management method and was mainly developed by the software development industry to reduce costs, time, and improve quality & delivery. It achieves this by breaking a project into several short incremental and repeatable tasks (known as sprints that are usually 1-4 weeks in length) and by seeking the collaboration of all stakeholders and by conducting daily scrum meetings.

Scrum is a popular agile framework (process) that helps teams work together. A simple definition of scrum is described by the Altasian website as” Scrum describes a set of meetings, tools, and roles that work in concert to help teams structure and manage their work”. It also explains the difference between agile and scum by describing agile as a “mindset” while scum is the framework that gets things done!

You will often come across the term “scrum master” which is equivalent to a “project manager” in a traditional project management environment. Other important terms you need to get familiar with are:

• Backlog:: A changing list of product requirement based on customer's needs
• Daily Scrum: A short daily meetings (10-15 minutes) to update plan
• Point of View (PoV): A summary of the relevant insights gained from observations
• Definition of Done (DoD):  A set of predetermined criteria that a product needs to meet in order to be considered as being done
  
  

  An agile manifesto was developed by 17 thought leaders in 2001 which consisted of 4         core values and 12 principles:

No.	Values	Principles
1.	Individuals and Interactions Over Processes and Tools	Customer satisfaction through early and continuous software delivery
2.	Working Software Over Comprehensive Documentation	Accommodate changing requirements throughout the development process
3.	Customer Collaboration Over Contract Negotiation	Frequent delivery of working software
4.	Responding to Change Over Following a Plan	Collaboration between the business stakeholders and developers throughout the project
5.		Support, trust, and motivate the people involved
6.		Enable face-to-face interactions
7.		Working software is the primary measure of progress
8.		Agile processes to support a consistent development pace
9.		Attention to technical detail and design enhances agility
10.		Simplicity
11.		Self-organizing teams encourage great architectures, requirements, and designs
12.		Regular reflections on how to become more effective

What Does it Mean to Have an Agile Internal Audit?

Now that you are familiar with the agile concept, let’s explore how the agile methodology applies to internal audit. Let’s start with the seven keys mentioned by Steve Denning in his above-mentioned article (these were based on a PwC report). According to the report, agile pioneers in internal audit embrace the following:

1.    active and broader involvement in disruption

2.    being prepared and adaptive

3.    assessing the risk of future disruption

4.    proactive involvement in disruptive events

5.    flexible talent management

6.    flexible planning

7.    meaningful collaboration with other lines of defense

Many articles and reports were written to discuss what an agile internal audit looks like. In general, there is an agreement that the characteristics of agile internal audit are:

• Flexible & adaptable planning and execution of work
• Continuous collaboration with stakeholders & daily scrum meetings
• Performance of work in repeatable sprints
• Less documentation
• Visualization of work on scrum boards
• Provision of incremental reporting

    

So, how does an agile internal audit compare to a traditional internal audit? A presentation by Deloitte included the following illustration which visualizes the difference: 

 

Many Internal audit manifestos were developed. Deloitte offered the following example:

Benefits of Agile Internal Audit

 There are many benefits of applying agile to internal audits which may include:

• Higher- quality insights and faster insight generation
• Increased customer satisfaction
• Enhanced internal audit planning
• Empowered internal audit teams
• Faster responses to changing business needs
• Less documentation
•  Accelerated delivery cycle
• Clearer outcome

It is important to understand that agile is not a call for internal audit to go rogue! Flexible planning, less documentation, and the empowerment of audit teams do not mean that there should be no discipline! It means that smarter use of time and resources are applied when and where most needed (i.e auditing what matters). And certainly, agile should not be interpreted as a call for internal audit to become "reactive”. The fact that internal audit shifts its focus to address emerging risks and disruptions does not mean that internal audit should be taken by surprise by an adverse event and struggles to react to it. Internal audit should anticipate such events, to the extent possible, and should be prepared to act quickly to address such issues in a timely manner.

  

Challenges of Agile Internal Audit

Obviously adopting and implementing an agile internal audit comes with challenges! An article published by Barclay Simpsons identified the following challenges:

• Changing mindsets: Agile auditing overhauls existing processes, which often creates tension among teams resistant to change. 
• Accessing support: Third-party coaching and development may be required to embed Agile methods into auditing functions effectively.
• Preventing burnout: Agile audits can be intensive, which may lead to negativity and burnout if not properly managed. 
• Apply Agile appropriately: Not all audits are suitable for the Agile approach. Businesses may need a hybrid framework to handle unique tasks rather than shoehorn every project through an Agile system.

Other challenges include appointing the right scrum master, adapting to less documentation, management buy-in, and most importantly the availability of skilled and capable internal auditors who are willing participants in agile auditing!

How to Start?

The first step of becoming agile starts with the internal audit function itself. To be precise, it starts with the mindset of the internal audit leadership to determine if it is ready for the change! Once this is accomplished, an evaluation of the capabilities and willingness of the audit team should be performed and a conclusion reached on the amount and type of outside help needed for the transformation. You may wonder if the agile approach is valuable for all internal audit shops? The chairman of the IIA Canada has answered this question as follows:

" I would say, yes. Most internal audit shops are within organizations that are currently exposed to disruption and significant change. The more a process or an auditable entity changes the greater the need for internal audit to have an agile approach to both planning and executing audits. Although, if internal audit is conducting compliance audits or audits related to an area with very little change since the last audit, choosing an agile approach may not add much value", 

The next step would be to educate the audit committee on the importance of the transformation to the agile methodology and to seek their support as well as the support (buy-in) of management.

Many experts advise that the agile approach be applied to a pilot project first. This can be used as a learning curve to evaluate and adjust agile to the company's needs. It may sound funny, but you need to apply the agile methodology to your agile transformation!

Agile requires continuous collaboration and feedback, so make sure that you seek feedback from all stakeholders and evaluate and implement them on a timely basis.

 In conclusion, an agile internal audit is…

The ability and willingness of internal auditors to leave their comfort zone and act swiftly and direct their efforts to risks and disruptions that matter through continuous risk assessment, timely & meaningful communications /collaboration with stakeholders, and utilization of available technology. The ultimate purpose is to provide management with real-time ( or at the speed of risk as some like to call it) insight, advice, and assurance needed to assist them with the decision-making process.

These are my thoughts, please share yours!

 

 ----------------------------------------------------------------------------------------------

 References:

-           https://www.qasymphony.com/blog/agile-methodology-guide-agile-testing/#

-           https://zenkit.com/en/blog/agile-methodology-an-overview/

-           https://www.pwc.co.uk/audit-assurance/assets/pdf/agile-auditing.pdf

-           https://www.atlassian.com/agile/scrum

-           https://www.wegalvanize.com/audit/an-overview-of-agile-auditing/

-           https://na.theiia.org/news/Pages/NEW-Global-Knowledge-Brief-Agile-Internal-Audit-Leading-Practices-From-CAEs-on-the-Journey-to-Becoming-Agile.aspx

-           https://deloitte.wsj.com/riskandcompliance/2018/08/06/mind-over-matter-implementing-agile-internal-audit/

-           https://www.gartner.com/smarterwithgartner/what-agile-means-for-internal-audit/

-           https://www.barclaysimpson.com/blogs/how-can-agile-methods-add-value-to-internal-audit-82774132037

-           https://baker-tilly-www.cdn.prismic.io/baker-tilly-www%2Fbbb7c85e-d9cc-4aab-a943-bf186f638a22_agile-internal-audit-transforming-internal-audit-to-add-greater-value.pdf

-           https://www.smartsheet.com/ultimate-agile-dictionary

-           https://chapters.theiia.org/IIA%20Canada/ChapterDocuments/Richard-Arthurs-Blog-December-Agile-Internal-Audit.pdf

Is IA success influenced by Board & Management desire?‎

The traditional perception indicates that “Internal Audit will be what senior management wants it to be “. I was reminded of this while reading the Framework for Excellence Article in the Ia magazine's February issue. In particular, this statement caught my attention:

“Ultimately, an audit department can only be as advanced as the board and senior management want it to be”

Do you agree with this statement?

More importantly, do you accept this as being the normal way of doing business?
Do you feel that Internal Auditors can influence how the Board & Management perceive their work?

Can you share your experience and share your success story?

picture credit:http://gearingforsuccess.ca/gearing-for-success/