Agile for IT audit facilitates highly adaptable planning processes, self-managed audit teams, early or more timely audit results, nimble responses to changes in an audit engagement, and emphasis on delivering optimal value. Agile also allows IT audit departments to focus on fewer tasks concurrently to deliver value at smaller but more frequent intervals, i.e., sprints, before moving on to additional phases within the audit engagement. Agile principles place a strict focus on the constant prioritization of work that will deliver the highest value to customers in the briefest period of time. The Agile audit tool set also draws inspiration from software development. Instead of legacy tools, such as spreadsheets or audit management software, the Agile audit tool set relies on software development tools, such as Atlassian Jira®, Kanban boards and sprints, to perform audit engagement planning, fieldwork and monitoring. Sprints are the short fixed-length iterations in which
defined work is completed
Agile methodology benefits audit departments by
Achieving rapid audit results
Avoiding siloed audit and customer teams
Communicating in near real time
Collaborating intimately with customer
Reduced end-to-end planning—Instead of planning audit engagements over several months, Agile reduces the planning process to weeks or even days due to condensed sprint cycles and a small-scale, iterative approach
Streamlined audit engagements—Combining the planning, fieldwork and reporting phases into a single cohesive engagement avoids the execution of disparate engagement phases with long lead times
Direct customer collaboration—Involvement of customers in the Agile scrum, i.e., daily standup meeting, at the beginning of the audit engagement sprint gives them a seat at the table. This involvement further facilitates their input in guiding the engagement to both valid and highly beneficial audit outcomes for all parties
Flexible audit scope—As new information is provided to or discovered by auditors, Agile facilitates real-time audit scope adjustments. Auditors should continue to obtain audit management approval as potential scope adjustments are discovered and be prepared to adjust testing focus as new information is discovered or provided by audit customers
Real-time assurance—Direct customer collaboration means customers are informed of audit findings or control weaknesses as they are discovered by auditors versus receiving a draft audit report toward the end of an audit engagement. Auditors should provide updates on potential findings or control weaknesses to audit customers as testing uncovers them
Frequent audit plan updates—The increased velocity of engagements produced by Agile IT audits provides an opportunity for the audit backlog and annual plan to be and revised more frequently. Unlike audit plans that are reviewed annually, Agile audit plans are reviewed every quarter (or more frequently in some instances) due to the Agile iterative approach to conducting an audit engagementrevisited
