Navigating dynamic environments: Agile Auditing in the SA Public Sector

Cobus van Rensburg

Internal Audit Manager: Moore Southern Cape

It is no secret that the world has undergone significant changes over the last few years. The recent COVID-19 pandemic, followed by two major wars in Eurasia, is but two of the factors that are still causing disruptive changes in the business world. Organisations are forced to adapt to rapidly dynamic environments to manage risk and continuously ensure the creation of stakeholder value.

Assurance providers, such as public sector internal and external auditors, also operate in these environments and are therefore confronted with the challenge of adapting their methodologies to effectively address the dynamic nature of government operations. Traditional audit approaches may struggle to keep pace with the everchanging environment, making it imperative for auditors to consider agile auditing practices.

Agile auditing can be defined as a flexible and iterative approach that aims to enhance the efficiency and effectiveness of audit processes. Originally derived from agile project management methodologies in the software development industry, agile auditing underlines the principles of adaptability, collaboration, and customer satisfaction (Wolters Kluwer 2021).

Agile auditing can be defined as a flexible and iterative approach that aims to enhance the efficiency and effectiveness of audit processes.

It also involves the adoption of more frequent communication strategies with audit clients to update audit plans and management schedules more regularly to reflect current risk management priorities, rather than

being limited to what was established at the beginning of the year. Some internal auditors have referred to this as “auditing at the speed of risk.”

The main benefits of agile auditing include inter alia improved risk identification; time saved; increased collaboration; shorter, but more effective meetings; more timely presentation of findings; and abbreviated audit plans.

Agile auditing is underpinned by several key principles. The remainder of this article will explore five of these principles:

1.Risk assessment: Agile auditing demands a more continuous risk assessment approach, where risks are not merely assessed at the beginning of the audit, but throughout the audit process. This allows for more timely identification of emerging risks and a quicker adjustment of audit plans and approaches to suit dynamic client needs. The South African public sector risk environment is full of uncertainties, emanating from factors such as fraud, corruption, fiscal sustainability, service delivery and infrastructure backlogs, socioeconomic factors, political instability and cybersecurity. By conducting risk assessments on a more continuous basis, auditors will be more proactive and more able to assist their clients in a dynamic environment. This principle requires auditors to respond faster to risks and changes, instead of merely relying on a plan and assessment that was conducted once at the beginning of an audit project.

2. Flexible planning: When adaptability is prioritised over rigid planning, auditors can respond to changing circumstances, instead of sticking to an outdated plan that was developed a year ago. Agile auditing requires a mere high-level plan that can be adjusted as and when circumstances change. The South African public sector is characterised by frequent policy changes and evolving priorities. Flexible planning enables audit professionals to navigate these uncertainties and changes. It ensures that audit plans remain relevant, responsive and aligned with the dynamic nature of the public sector environment. Additionally, as audit plans are based on a shorter term (example quarterly), the risk of outdated planning, is reduced.

3. Collaborative stakeholder engagement: This principle highlights the importance of continuous collaboration and communication with key stakeholders throughout the audit process. This will facilitate an improved understanding of the audit environment, identification of risks, and alignment of audit objectives with organisational goals. It will also assist auditors in navigating the political, economic, and social complexities intrinsic to South Africa. Engaging with government officials, policymakers, and citizens ensures a holistic approach to audit planning and execution. This goes beyond traditional stakeholder engagement during audits, which were mostly limited to communication at the beginning and at the end of the audit. The principle can also be extended beyond specific audit engagements. For example, auditors can arrange for monthly meetings with management to discuss business risks.

4. Iterative cycle: Agile auditing advocates for an iterative approach, where the audit is broken down into smaller cycles or “sprints”, which must be time-boxed. For example, during and internal audit review of information security controls, the audit team can break the audit project down into six sprints: Sprint 1, planning; Sprint 2, access controls; Sprint 3, data protection, Sprint 4, network security; Sprint 5, business continuity; and Spring 6, reporting. Each sprint will commence with a planning session, where the task, deliverables and timeframe of the sprint wil be determined. This wil be followed by daily stand-up meetings to discuss progress and challenges.

At the end of each sprint, the tasks and deliverabls are reviewed and presented to stakeholders. The sprint is the concluded when the team reflect on the sprint and discusses the aspects that went well and the aspects that needs improvement. For consulting audit firms, this approach holds specific benefits, as it can contribute to quicker, more streamline audit projects, which will assist in meeting deadlines and staying within budget limitations.

5.Harnessing technology: The optimal utilisation of information technology is one of the core principles of agile auditing. Technologies such as data analytics and artificial intelligence, can assist auditors to improve efficiency, gain deeper insights, and automate repetitive tasks. Although these technologies are used by many auditors, some audit teams are yet to exmplore them. Auditors that want to enjoy the benefits of agile auditing, will need to embrace these technologies.

Although the benefits of agile auditing is clear, some challenges

have been experienced by those who implemented it. For example, the approach requires a shift in culture, a new skills set and a need to embrace new technologies. Many organisations are resistant to change.

Agile auditing represents a transformative approach for audit professionals that offers a solution to navigate the challenges of a dynamic environment. By embracing the principles of agility, audit teams can enhance responsiveness, improve risk identification, and promote increased stakeholder engagement. While challenges exist, the potential benefits of agile auditing position it as a strategic imperative for auditors seeking to uphold the integrity and effectiveness of audits in the evolving landscape of the South African public sector.