cmc/cleberg.net

  1#+date:        [2023-08-18 Fri 00:00:00]
  2#+title:       Agile Auditing
  3#+description: My take on agile auditing: what it is and how it actually plays out.
  4#+slug:        agile-auditing
  5#+filetags:    :audit:
  6
  7* What is Agile Auditing?
  8
  9[[https://en.wikipedia.org/wiki/Agile_software_development][Agile]], the
 10collaborative philosophy behind many software development methods, has
 11been picking up steam as a beneficial tool to use in the external and
 12internal auditing world.
 13
 14This blog post will walk through commonly used terms within Agile,
 15Scrum, and Kanban in order to translate these terms and roles into
 16audit-specific terms.
 17
 18Whether your team is in charge of a financial statement audit, an
 19attestation (SOC 1, SOC 2, etc.), or a unique internal audit, the terms
 20used throughout this post should still apply.
 21
 22* Agile
 23
 24To start, I'll take a look at Agile.
 25
 26#+begin_quote
 27The Agile methodology is a project management approach that involves
 28breaking the project into phases and emphasizes continuous collaboration
 29and improvement. Teams follow a cycle of planning, executing, and
 30evaluating.
 31#+end_quote
 32
 33While this approach may seem familiar to what audit teams have
 34historically done, an audit team must make distinct changes in their
 35mentality and how they approach and manage a project.
 36
 37** Agile Values
 38
 39The Agile Manifesto, written in 2001 at a summit in Utah, contain a set
 40of four main values that comprise the Agile approach:
 41
 421. Individuals and interactions over processes and tools.
 432. Working software over comprehensive documentation.
 443. Customer collaboration over contract negotiation.
 454. Responding to change over following a plan.
 46
 47Beyond the four values,
 48[[https://agilemanifesto.org/principles.html][twelve principles]] were
 49also written as part of the summit.
 50
 51In order to relate these values to an audit or attestation engagement,
 52we need to shift the focus from software development to the main goal of
 53an engagement: completing sufficient audit testing to address to
 54relevant risks over the processes and controls at hand.
 55
 56Audit Examples:
 57
 58- Engagement teams must value the team members, client contacts, and
 59  their interactions over the historical processes and tools that have
 60  been used.
 61- Engagement teams must value a final report that contains sufficient
 62  audit documentation over excessive documentation or scope creep.
 63- Engagement teams must collaborate with the audit clients as much as
 64  feasible to ensure that both sides are constantly updated with current
 65  knowledge of the engagement's status and any potential findings,
 66  rather than waiting for pre-set meetings or the end of the engagement
 67  to communicate.
 68- Engagement teams must be able to respond to change in an engagement's
 69  schedule, scope, or environment to ensure that the project is
 70  completed in a timely manner and that all relevant areas are tested.
 71  - In terms of an audit department's portfolio, they must be able to
 72    respond to changes in their company's or client's environment and be
 73    able to dynamically change their audit plan accordingly.
 74
 75* Scrum
 76
 77The above section discusses the high-level details of the Agile
 78philosophy and how an audit team can potentially mold that mindset into
 79the audit world, but how does a team implement these ideas?
 80
 81There are many methods that use an Agile mindset, but I prefer
 82[[https://en.wikipedia.org/wiki/Scrum_(software_development)][Scrum]].
 83Scrum is a framework based on Agile that enables a team to work through
 84a project through a series of roles, ceremonies, artifacts, and values.
 85
 86Let's dive into each of these individually.
 87
 88** Scrum Team
 89
 90A scrum project is only as good as the team running the project.
 91Standard scrum teams are separated into three distinct areas:
 92
 931. *Product Owner (Client Contact)*: The client contact is the audit
 94   equivalent of the product owner in Scrum. They are responsible for
 95   partnering with the engagement or audit team to ensure progress is
 96   being made, priorities are established, and clear guidance is given
 97   when questions or findings arise within each sprint.
 982. *Scrum Master (Engagement Lead)*: The engagement or audit team lead
 99   is responsible for coaching the team and the client contact on the
100   scrum process, tracking team progress against plan, scheduling
101   necessary resources, and helping remove obstacles.
1023. *Scrum Developers (Engagement Members)*: The engagement or audit team
103   is the set of team members responsible for getting the work done.
104   These team members will work on each task, report progress, resolve
105   obstacles, and collaborate with other team members and the client
106   contact to ensure goals are being met.
107
108** Scrum Ceremonies
109
110Scrum ceremonies are events that are performed on a regular basis.
111
1121. *Sprint Planning*: The team works together to plan the upcoming
113   sprint goal and which user stories (tasks) will be added to the
114   sprint to achieve that goal.
1152. *Sprint*: The time period, typically at least one week and no more
116   than one month in length, where the team works on the stories and
117   anything in the backlog.
1183. *Daily Scrum*: A very short meeting held each day, typically 15
119   minutes, to quickly emphasize alignment on the sprint goal and plan
120   the next 24 hours. Each team member may share what they did the day
121   before, what they'll do today, and any obstacles to their work.
1224. *Sprint Review*: At the end of each sprint, the team will gather and
123   discuss the progress, obstacles, and backlog from the previous
124   sprint.
1255. *Sprint Retrospective*: More specific than the sprint review, the
126   retrospective is meant to discuss what worked and what did not work
127   during the sprint. This may be processes, tools, people, or even
128   things related to the Scrum ceremonies.
129
130One additional ceremony that may be applicable is organizing the
131backlog. This is typically the responsibility of the engagement leader
132and is meant to prioritize and clarify what needs to be done to complete
133items in the backlog.
134
135** Artifacts
136
137While artifacts are generally not customizable in the audit world (i.e.,
138each control test must include some kind of working paper with evidence
139supporting the test results), I wanted to include some quick notes on
140associating scrum artifact terms with an audit.
141
1421. *Product Backlog*: This is the overall backlog of unfinished audit
143   tasks from all prior sprints.
1442. *Sprint Backlog*: This is the backlog of unfinished audit tasks from
145   one individual sprint.
1463. *Increment*: This is the output of each sprint - generally this is
147   best thought of as any documentation prepared during the sprint, such
148   as risk assessments, control working papers, deficiency analysis,
149   etc.
150
151* Kanban
152
153Last but not least, Kanban is a methodology that relies on boards to
154categorize work into distinct, descriptive categories that allow an
155agile or scrum team to effectively plan the work of a sprint or project.
156
157See Atlassian's [[https://www.atlassian.com/agile/kanban][Kanban]] page
158for more information.