Becoming Agile in Internal Audit

In recent years, agile transformation (which was created for project management methodology in software development processes), has become popular among internal audit functions, as well as other business areas. An agile internal audit function represents more flexible audit planning, more structured relations with shareholders and better process improvement efforts in audit processes to be able to respond quicker to newly emerging risks in the company.

In order to deal with the main risks of internal audit, which are listed from the definition of internal audit, International Internal Audit Beyond compliance with its standards, internal audit can provide a self-assessment of the concept of agility. Agility; more providing assurance in the same or more risk areas using fewer resources, establishing closer relationships with its stakeholders, and this allows for more relevant, timely, and more effective reports, enabling greater access to strategic and tactical changes.

In businesses that have completed their agile transformation, the question arises of how internal audit will adapt to the requirements of the agile environment as well as how it will ensure its own agility. In a business that builds its business approach on agile foundations, beyond traditional business models, internal audit may need to restructure its organization and working procedures to keep up with the dynamism and pace of the business's agile working style. In such a case, the technical competence of the internal audit about the agile approach applied in the business, familiarity with the product and value creation procedures of the agile approach, how closely it monitors communication and work with the agile organization and teams, and how it will perform the reports become important.

The above analysis of the implications of the concept of agility for the internal audit function raises a series of questions that can be used to determine where an organization stands in relation to the level of agility needed for the internal audit function:

1.     Is the internal audit plan dynamic, taking into account the change in risk exposures during the year? Is the plan revised throughout the year?

2.     Have continuous monitoring / risk assessment mechanisms been established to monitor the changes in the business environment during the year?

3.     Do audit field studies constitute a reasonable percentage of the total internal audit capacity? Is the internal audit effort focused on identifying risks?

4.     Are the assessments timely to ensure that the necessary actions are taken with appropriate priorities?

5.     Are the reporting methods and formats detailed and structured that will not lead to inefficiency?

6.     Are audit studies planned by taking into account the demands of those who benefit from internal audit studies? Is there a constant communication with the auditees in the field?

7.     At the meetings held within the audit team, are the situations that block the flow of audits discussed and team motivation provided?

8.     Lack of direct access to data sources, communication difficulties with auditees, selection of inappropriate audit software and audit technology, high effort in low value-added areas, exaggerated internal procedures under the name of quality assurance, and difficult documentation and archiving procedures, etc. Are inefficiencies that arise due to reasons being dealt with?

9.     Does the internal audit function have the depth of knowledge and motivation to respond to change?

Although the concept of agility has become quite popular recently, it points to a change of mindset rather than promising a radical change for the internal audit functions of businesses that have not yet realized the agile transformation of business processes and have not changed their organizational structures in this direction. Although agility is not a concept that has been put forward based on an idea about internal audit, it brings to the fore a series of approaches that aim to eliminate inefficiencies for internal audit functions and focus on the 'real business' in terms of the idea it contains.

Since it is foreseen that the evaluations to be made within the framework of the concept of agility will develop risk orientation, contribute to proactivity and increase the added value offered to the stakeholders, the steps to be taken to achieve these can be summarized as follows:

• Establishing continuous monitoring / risk assessment mechanisms that will ensure the awareness of rapidly changing priorities and making the internal audit planning dynamic to respond to these changes;
• Focusing on the assurance and consulting services to which internal audit makes its real contribution, abandoning all unproductive tasks in the processes and focusing on real risk, while constantly conducting cost-benefit questioning;
• Conducting internal audit activities (especially relevance and timeliness in reporting matters) in a way that reveals 'real value' for stakeholders by maintaining two-way communication with internal audit stakeholders;
• Establishing structures that will provide teamwork communication to take measures to eliminate all inefficiencies, including issues that cause bottlenecks in internal audit processes.

While doing all these, it is essential to benefit from technology to the extent required by the environment and the business model of the enterprise. Only in this way can the agility level of the internal audit function reach the agility level of the enterprise and the environment, and internal audit can produce value-added outputs with time. When agility is achieved, it will also ensure that internal audit risks are properly managed by revealing the most relevant results with the least resources, in the fastest way.