Getting Comfortable with being Uncomfortable! Using Agile IA to transform your internal audit function. IIA New York

Getting Comfortable with being Uncomfortable! Using Agile IA to transform your internal audit function IIA New York - Agile Auditing May 18, 2018 Copyright 2018 Deloitte Development LLC. All rights reserved. 1

Meeting with you today Aditi Jain Senior Manager Risk and Financial Advisory Deloitte aditijain@deloitte.com Jennifer Hill Senior Consultant Risk and Financial Advisory Deloitte jennhill@deloitte.com Copyright 2018 Deloitte Development LLC. All rights reserved. 2

14% of CAE s have formally implemented an Agile IA approach, 41% are considering implementing it, 14% are not implementing while 31% are not certain what Agile IA is Source: Deloitte s 2018 Global Chief Audit Executive Research Survey Copyright 2018 Deloitte Development LLC. All rights reserved. 4

What is Agile?

In one word, what does Agile Definition mean to you? Nimble? Iterative? Fast?

What Agile is and is not Agile is a group of methods based on iterative development, where requirements and solutions evolve through collaboration between self-organizing, crossfunctional teams. Agile is not: It is not a single methodology It is not a set of tools It is not that easy (it is easy to understand, not easy to implement) Agile Lean Scrum Feature Driven Development (FDD) Kanban Adaptive Software Development These are now collectively referred to as agile methodologies, after the Agile Manifesto was published in 2001. Agile is not a silver-bullet Copyright 2018 Deloitte Development LLC. All rights reserved. 7

Agile Manifesto While there is value in the items on the right, we value the items on the left more. Individuals and interactions over Process and procedures Working software over Comprehensive documentation Customer collaboration over Contract negotiation Responding to change over Following a plan Source: www.agilemanifesto.org Copyright 2018 Deloitte Development LLC. All rights reserved. 8

Why bring Agile to IA? IA should transform to deliver on a broader set of expectations, providing assurance but also advising on and anticipating risks Objective: To deliver meaningful, timely and real time insights. Allows IA to respond quickly to changing business needs Reduces the time between requirement and delivery Builds the risk specific insights the customer needs Avoids delivering insights without quality problems Meets business commitments by reprioritizing scope Copyright 2018 Deloitte Development LLC. All rights reserved. 10

Traditional Audit vs. Agile Audit Impacts to Customer Traditional Internal Audit Planning Fieldwork 8 -? weeks Review Reporting Am I losing money? What is going on? POV POV POV POV POV Agile Internal Audit Planning 2 Weeks Sprint 0 Planning 2 Weeks Sprint 1 Planning 2 Weeks Sprint 2 Planning 2 Weeks Sprint 3 Planning 2 Weeks Sprint 4 Planning 2 Weeks Sprint H I am now more informed. I can react to and modify my plan based on the interim point of views. I have collaborated with the right individuals. Key Terms Defined Sprint: A time-boxed period during which the team will complete a set of prioritized stories. Point of View (POV):.A summary of the relevant insights gained from observations and stories. It is a condensed understanding of the area with highlights to relevant insights of the state of risk and controls. Time-box: Defined timeframe no longer than 2-3 weeks. Copyright 2018 Deloitte Development LLC. All rights reserved. 11

How was audit planning different? Audit Canvas Planning Differently Executive engagement Approaching from top down Flexible planning cycle Epics Features User Stories Copyright 2018 Deloitte Development LLC. All rights reserved. 12

Example requirements hierarchy Pickup Project Accounting Epic Epics Revenue Recognition Features Features Features As an auditor I want to determine if S2S transactions are recorded timely so I can report revenue in the correct quarter/year User Stories User Stories User Stories User Stories Meet with the business owner Obtain or document process flow Conduct end-to-end testing Task Task Tasks Tasks Tasks Copyright 2018 Deloitte Development LLC. All rights reserved. 13

How was fieldwork different? Sprint Interactive sprint planning Rules of the engagement Daily standup meetings Definition of ready done release New audit management tools Daily Standup Copyright 2018 Deloitte Development LLC. All rights reserved. 14

Perception vs. Reality Perception of Agile IA Anti-planning Agile IA in reality Enhanced, high value planning Less or no documentation Flexibility to define have to want to haves More rework Iterative delivery with a focus on quality One-size fits all Applies test, learn, and adapt mentality Copyright 2018 Deloitte Development LLC. All rights reserved. 16

Lessons Learned Limited Executive Sponsorship Delivering audit results without bringing the executives along the journey upfront on the have to haves Failure to Transform Leadership Behavior For true mindset shifts and transformations there needs to be executive level mindset shift Not Harnessing the Power of the Project Canvas Upfront buy in on whywhat-and how much to audit impacts stakeholder buy in and shorter reporting cycle Lack of Emphasis on the Right Risks Successful auditors are those that know when to stop and how much to deep dive into Depending on Distributed Teams Coordinating with resources across the globe can be challenging (leveraging technology) Lack of a Transformation Leader + Change Agents Transformations need a central POC to drive the transformation vision Minimal Commitment to Fast Feedback Audit Scrum teams that don t socialize results at the end of every sprint (one big bang report) Limited Emphasis on a Collaborative Culture Agile relies on cross functional teams that audit through cross functional collaborations Copyright 2018 Deloitte Development LLC. All rights reserved. 17

About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ( DTTL ), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as Deloitte Global ) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the Deloitte name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms. Copyright 2018 Deloitte Development LLC. All rights reserved. Copyright 2018 Deloitte Development LLC. All rights reserved. 18

Getting Comfortable with being Uncomfortable! Using Agile IA to transform your internal audit function. IIA New York - Agile Auditing May 18, 2018