Heads of Internal Audit Virtual Forum
21 October 2020
Please note:
- All Institute responses are boxed and highlighted blue.
- Where the chair comments in that capacity, this box is highlighted in yellow.
- For confidentiality, the identities of all delegates/attendees are anonymised.
Chair's opening commentsIt is important that we all understand the concepts of agile auditing so that we can make informed decisions about how we run our functions in future. Agile auditing developed from project management although the uptake has perhaps been slower than many may have expected – we are all at different stages and functions apply it in different ways. No two audit functions are the same after all. Internal auditors need an agile mindset, never more so than in recent months where the volatility of 2020 may have necessitated new ways of working. Agile in all its formats is here to stay. Sharing their experiences today are two functions that have started a journey of change – Sainsbury’s Bank and NatWest. A poll was taken at the start of the session, results are shown at the end of this document. |
Participants
Chair: Derek Jamieson - Director of Regions, Institute
Institute: John Wood - CEO
Institute: Liz Sandwith - Chief Professional Practices Advisor
Speakers: Sarah Haigh, Senior Audit Manager, Sainsbury’s Bank | Ann Maria Keogan, Senior Audit Manager, NatWest
Key takeaways
• Agile auditing is about mindset and a way of working.
• An agile framework is an overlay on the audit methodology. It does not replace it.
• Agile tools do not make agile work. It needs tone from the top and culture.
• The culture of agile is iterative improvement, evolution and learning from mistakes. A reflective element is embedded within each block (sprint) of planning, fieldwork, reporting/close. A sprint is typically 1-2 weeks.
• Agile is always a journey, even for mature experienced teams.
• Collaboration is essential both within the internal audit team and with the wider organisation.
• Agile is about delivering value. The first thing a function must decide is what value it wants to achieve in order to measure and manage it. Value can be many things such as improved relationships, sharing emerging findings early, flexibility to change direction or increase efficiency.
• One of the main benefits of an agile approach is that it forces blockers to be flushed out early for immediate resolution or escalation. This is achieved using short, disciplined 15-minute daily calls/meetings (often known as huddles or scrums). They focus on delivery and information sharing with detailed topics taken offline.
• Reduced delays are a notable outcome of agile auditing.
• Flexibility within the agile framework is essential, internal auditors need to be able to adapt to suit the type of audit being undertaken. One example is to use a tiered approach of best, good and minimum practice that should be applied.
• It takes time to develop an agile approach, both speakers talked about the importance of learning from others and using external support such as an agile coach, experienced peers and the IA Change Forum.
• Agile must be relevant to your function not over-engineered
Click here to access all of the presentation slides from this week's forum.
Institute's commentsThe Institute is looking to the future of internal audit. Agile is certainly one of the tools that will be important for the profession. As the speakers have articulated, it is not about complicated language or methodology. There are ways of doing things using terms that resonate with internal auditors and that we already use. Words that stand out include, transparent, collaborative and measurement, these are important to all internal auditors and essentially is what we already do. An agile mindset helps us think more efficiently and effectively Three top tips
|
Chair's closing commentsAgile is an interesting area for the profession. Unlike data analytics which I think should be compulsory for all internal audit functions, I think this is an area for consideration. What is compulsory is to look at how we can improve how we do internal auditing and if agile is the answer let’s adopt it. It is probably useful to all functions in some way. Time is running out to sit on the fence, decide and act, adopt as far as we can remembering one size doesn’t fit all. The national IA Change Forum (formerly a Scottish regional group) will continue discussion and sharing on agile internal auditing. If you are interested in joining this group, please contact Derek Jamieson (derek.jamieson@iia.org.uk).. Reminder: The first open meeting of the Data Analytics Working Group will be on 24th or 26th November. If you are interested in joining please contact Derek Jamieson. Also, please make contact if you are interested in sharing your experiences on a particular topic with the forum, we welcome contributors as collaboration helps us all to develop and improve. |
Next meeting
4 November – Shape the Future. Please join us to share thoughts and discuss how we can improve our focus on identifying and reporting on root cause. Recently, some members have expressed concern that they are not always achieving this so we will explore the topic in detail.
Poll results
| 1.) How are you seeing Agile being used for Change Programmes? | |
| All change programmes | 8% (2 votes) |
| Limited to software development programmes | 24% (6 votes) |
| Predominantly software and product development programmes | 12% (3 votes) |
| Piloting use (eg on a small number of change activities) | 40% (10 votes) |
| Not using | 16% (4 votes |
| 2.) Is your function using agile auditing? | |
| Yes | 32% (8 votes) |
| No | 68% (17 votes) |
| 3.) How mature is agile auditing in your function? | |
| Framework, principles and processes mature; evolution in progress for next iteration of agile | 4% (1 vote) |
| Framework, principles and processes embedded | 4% (1 vote) |
| Predominantly software and product development programmes | 8% (2 votes) |
| Piloting use (eg on a small number of change activities) | 28% (7 votes) |
| Not using | 56% (14 votes) |
Chat box comments from participants
Construction: Would you say ‘agile’ can take different forms? For example, we complete waterfall audits, but we are using data analytics for testing rather than standard testing methods.
Public: 68% was no, not currently. Why? Well, is agile particularly critical for FS IA teams given the lengthier audit durations, occasionally 'chilly' relations with the first line, more embedded and regulator-blessed three lines responsibilities and larger numbers of IA team members on individual engagements than we typically see in smaller organisations or the non-FS sectors?
Chair DJ: Interesting challenge. Any views from the group?
Anon: Perhaps due to relatively smaller sized IA teams in other industries.
Education: I agree with the comment - as a very small IA team, adopting full agile methodology would possibly be excessive for our needs. We are a team of three, each responsible for delivering reviews individually. Having listened with interest to the presentations, I think there are elements of agile working already embedded into our processes - we maintain regular contact with audit sponsors to update on risks / issues found, we have weekly team catch ups to agree the priorities for the week ahead, obtain stakeholder feedback regularly etc.
Public: We employ lots of the principles but not the pure methodology probably owing to size of audits we work on. Agree that there are also other ways of auditing at the speed of business such as already mentioned - continuous monitoring/continuous auditing using data analytics and in-flight project assurance.
Retail: I like the notion of smaller bite audits with rapid outcomes with close engagement with stakeholders. Don't think you need the scrum language - its distracting.
Corporate: From what I'm experiencing, if you are a smaller audit function, with smaller scope audits, you may well find that you are actually quite "agile" already. And adding lots of agile terminology eg Kanban’s etc may add to, rather than simplify your processes. So, we are trying to look at what are the key things we would like to try to get the benefits from.
