[Music] foreign [Music] students we are back with my friend Elizabeth to talk about agile auditing and we're just going to jump right into it we have heard a lot of people mention this concept of agile and I bet you guys have even in other classes and you've heard it in other videos in this course but no one has really explained exactly what that is so Elizabeth I'm going to put you on the spot right here at the beginning can you explain in just simple terms what how you would explain agile and specifically obviously there is a difference between just agile methodology and agile auditing so maybe kind of give a preview of both of those things and that's exactly what I was going to say is the agile methodology came about I think actually in the 70s as a result uh or or as an a way to try and do it projects smarter and and faster and more iterative so the idea is really that rather them planning out the entire thing and then going in order step by step we and my teams always hate it when I use this word but we chunk it and break it into smaller more digestible pieces that can be done but then also you check it off and you're done with that piece and then you move on and you have a lot more concrete uh support to show for what you're doing so in audit it doesn't completely translate from it to audit and so there's there's agile methodology there's agile audit and I think the agile audit incorporates a lot of agile methodology into it and I think that when it teams use agile they're much more prescriptive than audit teams are I think that it is important for us as Auditors to take bits and pieces what works for us what works for 150 member team isn't necessarily going to work for a three-member team um but understanding some of the core components and then making it work I like that and so instead of chunks which you know I that is kind of an odd word to use but I will give you too big of a hard time about it um Sprints right they're technically called Sprints in they are called Sprint okay all right so however you wanted to find it so I know you do a presentation for internal audit professionals um can you share just a piece you know tell us what you cover in that presentation uh and give the students an idea absolutely so what we're looking at here this is just one of the slides that we have can you see it and yes I can yep perfect so this explains traditional audit versus agile audit and I think that that's um kind of an easy way to understand uh where we might have uh historically or how we might have historically done things in internal audit versus an agile approach and how it might do it and I'm actually going to start at the bottom with this little graphic so we have the waterfall approach in traditional we have very defined planning stage and I've been in audit shops where you literally do not start field work until you have checked that boxes as you are done with planning and then you do field work and that's what you do you do field work yeah and then I'm done with that you do reporting and so you go from one to the other versus if you look over here on agile it is a much much more flexible iterative approach and as Joe said these are Sprints so this is visually demonstrated as three two-week Sprints but you have each of these same phases in each Sprint so planning field work review slash reporting planning field work review or reporting and you're doing that constantly and constantly reevaluating what is important where are the highest risks what maybe isn't as important as we thought when we first started scoping this out if it's not important we don't need to do it just because we thought we should go when we started planning and I think that historically a lot of time has been spent in planning trying to figure out every single thing we could possibly need to know but in the end that's really not efficient and so this is much more a learn as you go and audit smarter not harder type of methodology um but one of the issues with traditional audit is that it's susceptible to bottlenecks and other inefficiencies in part because you're so focused on staying in those discrete phases versus prioritizing according to the risk and the value as I mentioned um I think and feel free to jump in if you want to jump in with anything um but traditional audit also isn't quite as collaborative as agile is and I'm sure that you've heard in your other videos that you've done internal audit these days is very much about collaboration collaboration with management collaboration with our clients collaboration with the board versus US kind of setting ourselves up on a pedestal and telling everyone well we're in a we're internal audit you know you need to do it this way and so part of that means having much more frequent communication accepting influence from the client and what I mean by that is not letting them dictate scope not letting them tell us what to do but really hearing them in terms of maybe this thing that we think is a really big deal really isn't an issue and here's why and having that more frequent communication and in turn then not having a lot of surprises at the end of the audit because I think that one of the keys to having good relationships with management and with really all of our clients is not being the policemen police people who are kind of working in secrecy and then bam hit you with a report at the end and surprise you it's they don't there should not be any surprises in what we do and so that's all discussed in weekly meetings there should be a meeting every single week for an audit even if it's just to discuss what do we still need from you what documentation do we need what issues are we finding how is the audit going there's no I don't think there's any value in keeping all of that a secret unless it's something like an investigation that you need to keep um much more confidential and that really goes to this last point which is traditionally in traditional audit I think the value is delay until the end of the audit and that can especially for some larger audit shops where some audits can be just absolutely massive and take months and months you could have an audit client that's like what are they doing why what is the value that they're adding versus if you're constantly providing the recommendations and the feedback as part of these two-week Sprints then their understanding as you go um the value that you add and the last thing I'll add is also if there are issues identified you want to give people a chance as soon as you can to remediate them there again there's no value to waiting to the end and then presenting a massive list of issues let them fix them and then in when the report does come out it can say already remediated it'll still be in the report but it'll show that it was already addressed and that also shows awesome collaboration and communication with the client um there was like so many Fantastic things that you said in that like I don't know how long that was but that was awesome thank you um and my favorite thing that that you said was accepting influence from your clients so I think that's going to be my new favorite uh two words because I love that so many Auditors are so worried about independence right and they stop talking to their clients all together and then you're you separate yourself so much that you're not even looking at the right risks or scoping in the right things and and so I really like that whole idea of accepting influence well and I think along with that is then that again like you said the divide that happens there's a Chasm if you will between internal audit and the client it also makes them a lot less likely to tell us things and ask for an audit in an area it's so awesome when you work for a company and somebody comes and says I want you to audit I know you're gonna it's not gonna be punitive it's not gonna be a painful process it's just going to help us get better and that is so rewarding but that comes from hearing them and listening to them and not just um being the auditor um and being so strictly um bound to that must be independent mindset yeah yeah still be independent and operate this way yeah absolutely and I do want to go back to also say uh what you said at the beginning about how every internal audit shop can do can Implement agile a little bit differently and I want to kind of go back to that concept really quickly because I think you're completely right I.T you know when they're doing a project they tend to be pretty strict in this agile you know approach um but for audit you know when I think about some of the things that I've done in my past career as the director of internal audit we were agile but we didn't do weekly meetings we did weekly emails that just said here's what we're waiting for here's what we found this week you know here's you know just kind of updates right and when you think about it even something like that is implementing a little piece of agile framework and so what I want the students to get out of this is is it doesn't have to be you know the whole methodology it's not all or nothing yeah exactly it's not all or nothing and you can kind of choose and we've we've gone through um obviously planning field work performance and then um reporting which I like to call communicating now right um and and I love your visual of just saying we're doing all those three things we're just doing it quicker which I think is one downfall of our profession is that sometimes our audits take way too long so it's it's just doing everything more quicker so I like to think of agile obviously as more efficient in um and what we do and one other thing I just want to mention as you were talking I'm thinking this is exactly what I I love the term just in time auditing so it's like looking at the right risks at the right time with the right people you know with all of that and I think agile auditing really makes us do that quicker right and it's really just in time auditing so I like that absolutely how do you how do you see now I mean I say we've been really embracing this as a profession maybe over the last what five years I mean it really hasn't been that I don't know some of us had probably been doing it longer than others but what how do you see it making internal audit shops better or more efficient like I think it's everything you've probably talked about communication better rapport with a client any other things I think that it kind of uh for lack of a better term it cuts out a lot of the fat uh in terms of I one of the things I like to focus on is agile audit reporting and completely redoing your audit report and taking it from 15 page just honestly snooze Fest that you can't even read the entire thing to a crispr smarter shorter audit report that really if you've got an executive or someone on the board who they have 30 seconds to read that they can go straight to the conclusion read the conclusion if that's all they read they still know what they need to know about how that audit went and I think that that's really important yeah I mean it's they it's made us better communicators ultimately yeah like you said either verbal because we did used to be holding in our issues until the end I know when I first started in 2005 that's what we did it's like don't tell them what you found until the end and so it's making us more you know efficient effective communicators throughout it doesn't make the end of an audit project is scary because you've been taught talking about these issues transparently throughout the project and now going into an a you know an end meeting where you're going through the whole report is it nearly as daunted right yeah and it's interesting because it's not even just confined to an audit project I think that the agile components uh can be taken throughout your entire um I guess methodology for your department and so as part of that we would have either monthly or quarterly or semi-annual depending on what part of the audit Universe we were talking about but we would have collaboration meetings with our client and we would let them know maybe in q1 you've got an audit coming up in Q4 this is what we're going to be looking at this is what we're going to be looking for and I think historically we were taught well don't tell them if you tell them then they might fix it and I'm as I've gone through my career I'm like isn't that the point that they fix it we want them to pay for it yeah if we find it or if if they know and fix it ahead of time the point is to make the organization safer and smarter and so I think embracing that mindset of it doesn't need to be internal audit kind of getting the credit because I think we can show our value in so many ways um but really implementing these different agile methodologies across the board yeah I love that I I was literally as you're talking I'm like yep I've totally been that you know that like they want us to do surprise audits right and they don't want to you don't want to tell them you're coming and but there is value in telling them that you're coming and getting ready for that and and maybe good things come out of that so yeah that was funny if you're gonna do it better all year before implementing Q4 then why not that's that's awesome that's so funny well thank you so much for sharing agile with us I've been uh ending some of these interviews with advice for students so um you know I think I'm thinking as we're talking there are so many benefits to being agile in our own personal lives I think that's one piece of advice I would give students students but what else would you say to students so I'm gonna end with my motto and I don't think it'll get you your e rating um but motto is is don't be an and I mean by that is you know there is room for all of us to succeed in our personal lives in our professional lives let's just help each other out and build each other up and just be kind to each other and I think that the other thing that's really important with audit specifically is be curious don't just it doesn't just have to do with accepting an answer that a client might give you but it's also just constantly wondering why are they doing it this way is there a better way to do it you can ask the question maybe the answer is no and that's okay too don't be afraid to fail um I think that normalizing failure is really important and so yeah I've got a lot of advice we could do a whole another section of that I love it well those two things are fantastic so be kind and be careful right we'll leave them with those faces thanks so much thanks for being a great friend and thanks for sharing with the students thank you