Citigroup

Using Scrums and Sprints – Adopting Agile for

Internal Audit

Lorraine Hogan, Chief Auditor

Global Consumer Banking
APAC and EMEA Internal Audit, Citi
May 2018

Strictly Private and Confidential

 Agenda

1. Practical insights into using scrums and sprints in audits – setting it up and making
it work Item
2. Addressing the challenges of introducing agile into audit planning, execution and
reporting
3. Ensuring quality outcomes in an agile environment
4. Realising the efficiencies of using agile in internal audits

2 #DrivePositiveChange
 Agile Auditing
What is Agile?
• An alternative to traditional project management methodology, typically used in
software development
• A framework within which many processes and techniques can be operated
• Involves incremental time-boxes, known as sprints, within which agreed activities will
be completed

Where does Internal Audit fit into this?

• "Internal audit is a dynamic profession involved in helping organisations achieve
their objectives. It is concerned with evaluating and improving the effectiveness of
risk management, control and governance processes in an organisation.“ [IIA]
• In a world of innovation, the traditional way of operating loses effectiveness
• Agile auditing provides an alternative to the traditional sequential audit process, not
changing ‘what’ we do but ‘how’ we do it

3 #DrivePositiveChange
 Agile Auditing
A new way of thinking

The traditional audit approach has been standard and sequential –

Traditional Risk Based Audit

Planning Fieldwork Reporting

In applying an agile approach to audit, the approach is more flexible, responsive to

changes, and based on enhanced engagement with business stakeholders

It allows an iterative approach, with the aim of completing testing, identifying and
agreeing issues and agreeing on draft issue wording within each sprint

The most important aspect of Agile is stakeholder engagement

Increased focus on enhanced and transparent communication with the stakeholder

forms the basis of Agile Auditing

4 #DrivePositiveChange
 What is it and how is it different? (continued…)
It changes ‘how’ audits are approached, but not ‘what’ we do

Agile Auditing Flexibility

Reporting
Daily Scrum Sprint Review Daily Scrum Sprint Review Sprints
Finalize audit report
wording after dropping
in agreed draft issues.
Complete internal
Planning Sprints Fieldwork reviews
Identify risks and Sprints
controls, design Test operational
effectiveness testing, effectiveness of
discuss exceptions, controls, discuss
Sprint Planning agree draft issue Sprint Tasks Sprint Planning exceptions, agree draft Sprint Tasks
wording and corrective issue wording and
action plans corrective action plans Audit
Reporting

Retrospective Retrospective

Sprint Planning and status update: Ongoing Sprint Preparation (Backlog Management)

In addition to enhanced stakeholder engagement and greater transparency, adopting an

Agile approach to our audits should result in more timely assurance through reduction in
overall time to reporting

5 #DrivePositiveChange
 Implementing Agile Auditing
Agile Auditing
Adopting an Agile approach to our audits
means all stages in the audit can be set
to predetermined time periods known as
sprints.
• Scrum team is self-governing, and
determines the tasks to be completed
within each sprint
• each sprint should be of equal length
• audit activities and deliverables
(meetings, artifacts, DEA/OET testing,
documentation completion, reporting)
are clearly mapped to specific sprints
• allows for targeted stakeholder
engagement, through inclusion of
relevant activities in specific sprints
6 #DrivePositiveChange
Scrum/Stand Up meeting
Short, sharp meetings on a daily basis
(although frequency can differ) lasting
15-30 minutes, and for which it is critical
to keep to time.
• Meeting covers (1) what was done
yesterday; (2) what will be done today;
and (3) roadblocks
• As the sprints progress it is also
important to discuss (4) potential
issues
• members of the audit team and key
business stakeholders are scrum
team members
 Implementing Agile Auditing
Key roles Sprint delivery

Product
Product or
Backlog
Outcome
Owner

Scrum Master
Sprint Backlog

Scrum Team
Project
Manager

Scrum Team
Scrum Team
(Key business
(Audit team)
stakeholders)

Reviews and Revise the backlog,

Sprint Activities
Retrospectives revise the approach

7 #DrivePositiveChange
 Our Pilot
Daily stand up scrum sessions (20 mins)
What we did
What we will be doing today
Roadblocks
Sprint Potential observations
Planning

Daily
scrum

Scrum
Board

8 #DrivePositiveChange
 And Now…

Training materials, sharing experiences,

roll out across the IA function. Every
team completing at least one audit
using Agile approach in 2018.

Virtual scrum board using Microsoft

OneNote. Upcoming JIRA trial.

Scrum /stand up meetings at different

frequencies – may not need to be every
day. Mix of video and face to face
meetings.

Identifying good opportunities for

improvement, for example coaching
junior audit team members to be more
comfortable in speaking and responding
to senior stakeholders.

9 #DrivePositiveChange
 Addressing the Challenges
The Challenge
Obtaining buy in and
commitment from capable
stakeholders
Continuous engagement
and managing the intensity
Initial steep learning curve
Monitor sprint timelines and
manage sprint backlog
Co-location of team and
stakeholders vs
geographically
decentralised
10
How to Address
Advance communication and getting agreement in advance
Deliver what you say you are going to do
Transparency re other responsibilities and tasks actively
managed to maintain focus on sprint completion
Scrum team to operate as one team, training and experience
sharing in advance, regular ‘agile’ touchpoints across teams
Separate scrum master and project manager
Transparency within scrum team
Sprint reviews completed at end of each sprint
Co-locate when possible
Use technology – virtual scrum boards, screen sharing, video
conferencing when co-location isn’t possible
Try fast fail fast – an agile mindset
#DrivePositiveChange
 Realising the Benefits
Benefits
IA staff development
Ability to quickly adjust to
changes in scope
Increased and better
quality team and
stakeholder relationships
Better and more
transparent tracking of
progress
Faster conclusions on
issues and agreement on
the final report
Shorter elapsed time for
audit execution
11
How to Realise
Self governing scrum team – all members get to contribute to decisions
on how to run the sprints
Exposing new development needs which can be addressed
Carefully consider team composition
Regular scrums with all team members, and senior stakeholders,
participating, allows fast response to information as it comes to light
Regular scrums with all team members, and senior stakeholders,
participating
Scrum reviews and retrospectives
Audit story board as a point of reference (physical or virtual), tracking
daily scrum updates and statuses, roadblocks, progress, potential issues
Regular scrums include discussion on potential issues from the moment
exceptions are identified.
Aim for sprints to include agreement on factual accuracy/draft wording of
issues, provision of corrective action plans
#DrivePositiveChange
 In Summary
• The beauty of an agile approach is that it lends itself to trying new ways of working
and allows teams to try fast, fail fast and move on
• In order to address the challenges of implementing an agile approach, focus on
communication and transparency, as well as team composition
• Quality can be improved and efficiencies gained with an agile approach:
o Scoping flexibility can be enhanced through better information sharing and scrum
team inputs
o Scrum team discusses and clears roadblocks
o Exception discussion starts immediately on identification
o Scrum meetings enable sharing of senior stakeholder insights on an ongoing
o Draft issues and corrective action plans are deliverables from each sprint

12 #DrivePositiveChange
 Thank you

13 #DrivePositiveChange
14
 2A
Using scrums and sprints – Adopting agile for
internal audit
Lorraine Hogan CIA MIIA(Aust)
APAC Regional Internal Audit Director
Citigroup