Training: Lean Auditing
I have been running courses on Lean auditing since 2010. It’s been a pleasure to work with so many internal auditors who recognise that internal audit can become more impactful, dynamic and value adding. Recently, people have asked questions about agile audit; so here are some key messages that I hope will clear up any confusion.
Lean techniques emerged from the auto production-line in Japan in the 1960s and then spread into other industries and business processes. The goal is to deliver value to customers with minimum waste by considering the “value stream” and making a process “flow”, so eliminating waste and bottlenecks. Many ideas developed by Lean are now ubiquitous, such as process mapping; listening to the “voice of the customer”, “right first time” and “just in time.” Lean ways of working are not about cost cutting; although Lean has been hijacked by some for this purpose.
The Lean Auditing workshop focuses on how we can use Lean to make internal auditing impactful – to get more with less. However, Lean auditing is not about Lean for its own sake, and it is not about sacrificing IIA Standards. When I researched and wrote the book Lean Auditing, I was determined that Lean ways of working must be considered in the context of the Standards. In fact, Lean is aligned with the Standards in many ways and can help with some of the dilemmas we have to manage, such as the balance between auditing and advice, and how to ensure that audit plans focus on the right areas.
The roots of Agile were put down around 1974 with “adaptive software development”, which led to “scrum for software development” inspired by Nonaka and Takeuchi. Key Agile principles include:
• Individuals and interactions over processes and tools.
• Working software over comprehensive documentation.
• Customer collaboration over contract negotiation.
• Responding to change vs following a plan.
Since then, Agile concepts have been adapted across various business areas. Other key Agile ideas and techniques include: the quick delivery of a good enough product; taking an iterative approach; using scrums and sprints to drive pace and working on a prioritised backlog of issues. What auditors often like about Agile is its emphasis on face-to-face communication, being tough about what matters most, and its emphasis on overcoming blockers. Many of these themes also apply to Lean ways of working.
Whether we use Lean or Agile techniques matters less than whether it enhances our work. Typical improvements from both approaches are:
• More assignments delivered on time and less over budget.
• Greater relevance to the organisation’s key priorities.
• Reduced chance of managers saying: “we already knew that”.
• More findings that address root causes, resulting in fewer findings with a greater impact and shorter audit reports.
• A more streamlined follow-up process that maximises the chances of remediation by management without delays.
• A culture in the audit team that allows auditors to use their intelligence to make sensible judgments, recognising that this can challenge rigid audit methodologies and the capabilities of some staff.
Both techniques help us to move forward and become more dynamic and impactful. That said, we should not follow new approaches without considering their practicality, risks and what they mean for our role and compliance with the Standards. We should be mindful of getting caught up in fads. If we cut the wrong corners we may make recommendations that are not robust, fail an EQA or fall foul of regulatory demands.
James C Paterson is a former head of audit and delivers courses for the IIA on topics including Lean Auditing.
This article was first published in March 2020.