Agility in Audit: Could Scrum Improve the Audit Process?

The audit environment is currently undergoing a fundamental change due to technological advancements such as data analytics and artificial intelligence (Agnew 2016). While an audit has always been subject to disruptive influences such as acquisitions, new information technology implementations, or last-minute changes in control reliance, developments in technology are automating many labor-intensive tasks that have given traditional audits a perceived level of predictability (Kokina and Davenport 2017). Because of this perceived predictability, audits have historically relied on big design up front (BDUF) planning as the primary project management technique. The level of specificity in BDUF audit plans offers limited flexibility when unexpected changes occur, particularly in the later stages of the audit. Further, as the audit process evolves due to technological progress, the structure of an audit engagement will likely need to adapt as well. This paper explores the potential current and future need for more audit agility and specifically describes Scrum as a possible way to bring agility into the audit process.

Management and organization theory presupposes that successful organizations are highly compatible with their external environments. Organizations use various strategies to achieve environmental harmony, although many of the approaches have significant flaws (Worley, Williams, and Lawler 2014). Incorporating the concept of organizational agility may allow firms to become more compatible with their environment. The basic premise of agility is that in order to create sustainability, organizations must be able to adapt to an ever-changing environment. Agile organizations are able to rapidly change and adapt in response to changes, which is “fundamentally necessary for organizations facing changing conditions” (Cegarra-Navarro, Soto-Acosta, and Wensley 2016).

Agile originated as a project management philosophy in the software industry. It is based on the principal of “inspect-and-adapt” (Rabon 2013). McKinsey & Company (Aghina, de Smet, and Weerda 2015) share these thoughts on organizational agility:

Could the audit process as currently structured benefit from more agility? Signs that a firm's current audit process could use more agility include the following:

1. Engagements are consistently over budget.

2. Engagements are easily disrupted by unexpected client-related issues or delays in client readiness.

3. Individual audit areas are rarely finalized until the very end of the audit.

4. A lack of innovation and new ideas.

We surveyed 27 audit managers, directors, and partners of audit firms (see Appendix A). Thirteen people responded to the online questionnaire (48 percent response rate), representing local, regional, and international audit firms. Auditors' responses to the five-point-scale questions—where 1 is strongly disagree and 5 is strongly agree—indicate that audit firms could benefit from becoming more agile. Eight of 13 respondents disagreed that “project management was not a significant issue for audit engagements” (score = 2.62), which is consistent with respondents disagreeing that “the audit environment is consistent and predictable” (score = 2.23); only one respondent somewhat agreed. Moreover, respondents barely agreed (3 = neither agree nor disagree) that “audit engagements are earning an acceptable rate of return” (score =3.23), further suggesting that firms can benefit by becoming more agile.

Although the audit environment has traditionally been viewed as relatively stable, technological disruptions are making the future of audit more uncertain. Adapting to environmental forces is becoming more imperative as the audit moves into the future and will significantly affect the audit process (Alles 2015). For example, as machine-learning technologies become more prevalent, statistical sampling will potentially give way to 100 percent testing and using an audit-by-exception (ABE) approach (Appelbaum, Kogan, and Vasarhelyi 2017). While current standards require auditors to investigate all exceptions found in a sample, researchers note that testing 100 percent of transactions might lead to thousands of exceptions, which may be unreasonable to examine in total and far exceed what was planned (Dohrer, Vasarhelyi, and McCollough 2015).

As new patterns of behavior emerge, the ability to adapt quickly to a dynamic audit environment will likely be of significant value in a data-driven audit world. Rather than passively awaiting change, agile audit firms and teams will constantly seek out and evaluate new information to enhance audit quality by continually refining the audit processes. The resulting audit approach should be more streamlined and tactical, allowing auditors to quickly adapt to ongoing analysis of real-time data. Further, the deadline-oriented nature of auditing creates significant time pressure that can lead to lower audit quality (Rezaee et al. 2016). By being prepared for and embracing unexpected changes, agile audit firms and teams should see improved efficiency and audit quality over time.

Becoming an agile organization takes time and commitment. Agility requires firm-wide changes in culture, mindset (beliefs), behaviors (skills), and structure processes) (Gibbons 2015). Changes in culture and mindset will not be sustainable without changes in actual behaviors and structure. This is why Worley et al. (2014) note that it is better to be structured for agility than to be agile when necessary.

Scrum is a popular way to introduce agility and can provide an agile structure to the audit process due to its simplicity and flexibility. Scrum is more than simply structure, however, as it requires changes in culture, mindset, and behaviors. Figure 1 models how Scrum incorporates these agile elements as well as external environmental forces.

Scrum is “a framework within which people can address complex adaptive problems, while productively and creatively delivering products of the highest possible value” (Schwaber and Sutherland 2017). By clearly identifying desired results and outcomes associated with project management and work techniques, Scrum allows firms to continuously improve the product, the team, and the work environment (Schwaber and Sutherland 2017). Scrum recognizes that organizations, teams, and people are complex adaptive systems and continually questions whether there are better ways to achieve project-based objectives. Scrum is different from other agile techniques, such as Kanban, because Scrum places emphasis on short iterations of work.

Scrum is based on the assertion that knowledge and continuous improvement come from experience and making decisions on what is known. As shown in Table 1, Scrum's effectiveness is built on three pillars: transparency, inspection, and adaptation. Transparency requires that a common language be shared by all participants involved. Inspection is necessary to ensure that the desired goal will be met. Inspection should not be so frequent that it impedes progress, but it must be frequent enough to detect undesirable variances in a timely manner. Adaptation requires adjustments to be made as soon as possible when undesirable variances could result in an undesirable outcome. All three pillars are essential for the team to learn from its experiences and adapt its activities to meet the demands of an ever-changing environment (Schwaber and Sutherland 2017).

Scrum teams work in short, sustainable work cycles called sprints to produce a high-quality working product at the end of each sprint. Sprints are designed to maximize the team's focus on the current tasks, including ample time to review, reflect, learn, and adapt. Sprints last from a week to a month, depending on the amount of time needed to produce a meaningful increment in product value for a given project. Sprint length remains constant throughout the project to help the team develop its work rhythm and accurately predict the amount of work it can accomplish (Schwaber and Sutherland 2017). By implementing more reviewing, reflecting, and learning, audit teams can develop a better understanding of the impediments to performance. Over time, teams increase their problem-solving capabilities and become more flexible and adaptable to environmental forces.

As outlined in Table 2, all team members must embrace the values of commitment, courage, focus, openness, and respect for Scrum to be successful (Schwaber and Sutherland 2017). Members must commit to achieving the goals of the Scrum team rather than to personal objectives. The team members understand that the accomplishments of the team and the continued improvement of its processes are the keys to success. Members must have the courage to behave ethically, regardless of the difficulty of the situation because people often look for shortcuts when challenges or impediments arise (Schwaber and Sutherland 2017). Scrum requires its members to be open to inspection so that inefficiencies can be corrected and impediments removed, resulting in improved performance and quality (J. Sutherland and J. J. Sutherland 2014).

Clearly articulating sprint goals and their importance ensures that the team focuses its attention on these goals. Scrum requires team members to be open about all work and challenges associated with the team's activities. By openly sharing all challenges and obstacles, the team can correct inefficiencies and remove impediments. Finally, team members must respect each other to be accountable and capable. Adherence to these five values is necessary to achieve the desired benefits of Scrum: transparency, inspection, and adaptation.

Table 3 summarizes the key skills required for each Scrum role, which are as follows:

• Product Owner: Responsible for the firm's return on investment (ROI) from the development team. The product owner does this by prioritizing the product backlog items (PBIs)—the prioritized list of remaining items to be completed by the development team during the project—to rapidly create value for the customer (Sutherland and Sutherland 2014).

• Development Team: A cross-functional, self-organizing group of five to nine members who do the actual work. Team members have no predetermined role or rank. This size is large enough to have sufficient knowledge to complete a sprint, but small enough for communication and coordination to be simple and effective.

• Scrum Master: Essentially the team's coach, not its boss (Sims and Johnson 2011). The scrum master serves the product owner by delivering a high-performing, self-organizing team. The Scrum master protects the team from outside distractions, removes project-related impediments, ensures that the entire team adheres to the spirit and rules of Scrum, and provides the best possible work environment for the team.

Scrum processes and structure revolve around the performance of the development team completing its current assignments as well as improving its processes for future assignments. As shown in Table 4, the events within Scrum that help achieve those ends include the sprint, sprint planning, daily standup, sprint review, and sprint retrospective. During each sprint, the development team creates “a useable and potentially releasable product increment” (Schwaber and Sutherland 2017). Quality objectives are never compromised, although the scope can be renegotiated or clarified as new information is obtained. It is the product owner's responsibility to ensure that the sprint goals accomplished meet the clients' needs.

Sprint planning involves the entire Scrum team. The purpose is two-fold: to determine what product increment can be delivered during the next sprint, and what work must be done to accomplish it. The product owner determines which PBIs are most important based on the current product increment and client's most pressing needs, while the development team commits to completing only as many items as they can realistically accomplish at a sustainable pace based on their past performance. A key development team assessment tool is the daily Scrum. The daily Scrum is also referred to as the daily standup because all team members remain standing to keep the meeting brief. During this brief inspect-and-adapt meeting, each team member shares what she completed yesterday, what she will complete today, and identifies impediments that could slow her down (Sutherland and Sutherland 2014).

Each sprint concludes with two meetings. The sprint review is a public meeting where the team presents its accomplishments to the client and other stakeholders and gets feedback from them (Sims and Johnson 2011). The Scrum team can review things like budgets and timelines to help optimize value during the next sprint. The sprint retrospective follows the sprint review. The retrospective allows the Scrum team an opportunity to inspect itself and identify one or two improvements in how the team functions that will be implemented during the next sprint (Sims and Johnson 2011). Both the review and retrospective focus on helping the team understand what was done in the past and how to adapt, learn, and improve in the future, related to both the specific project and the Scrum team's processes. Sprint reviews and sprint retrospectives are key aspects of the Scrum process that allow teams to reflect and continuously improve.

Done is perhaps the most important Scrum concept. Everyone involved with the project must understand what it means to complete an item. This definition should not contain any qualifiers: no “except fors” or “buts.” As the team improves its effectiveness, the definition of done often requires an increase in the quality of work. Effectiveness should never be accomplished through a reduction in quality (Sutherland and Sutherland 2014). The concept of “done” provides teams with near-term specific and achievable goals that are an imperative part of team success (Katzenbach and Smith 1992). Additionally, the development of client deliverables to coincide with “done” could be considered value-added to clients and result in improved customer satisfaction.

Under the current audit environment, a sprint could contain a “done” deliverable for each phase of an audit (e.g., planning, interim fieldwork, and final fieldwork or pre-reporting). For extensive engagements, a sprint might contain a “done” deliverable for each audit area or cycle (e.g., accounts receivable or the sales and collection cycle). Scrum could also facilitate a more proactive approach to audit planning and would align well with the Public Company Accounting Oversight Board's (PCAOB 2010a) Auditing Standard 9, which states that “planning is not a discrete phase of an audit but, rather, a continual and iterative process.” For example, as part of the comprehensive risk assessment process, the PCAOB (2010b) requires a fraud brainstorming session among all key engagement team members. Scrum could enhance this process by using daily standups to update the team on changes in fraud risks throughout the audit. Finally, moving to a more continuous audit will likely require increased audit agility as planning and the up-front risk assessment process may be limited to known significant or unusual transactions, and risks in individual audit areas are identified on a more real-time basis. The ever-changing audit environment may require teams to make tactical adjustments to their planned audit approach as discovered data dictate.

The PCAOB has expressed concern with the impact that staffing shortages can have on audit quality, stating that professional skepticism may be inversely related to the time remaining for the audit to be performed (Ferguson 2016). They mention that firms should have adequate resource bandwidth to deal with any last-minute crises and unexpected events (Ferguson 2016). Scrum could potentially help with resource problems in multiple ways.

First, daily standups help ensure that issues and impediments to completion are addressed in a more real-time manner. Second, sprints and the corresponding focus on “done” help create an audit environment that limits procrastination, which enhances supervisory reviews. Finally, last-minute audit issues can still arise at times, and Scrum should help firms better understand their existing resource needs in order to make more agile decisions regarding effective resource allocation (i.e., Scrum is designed to deal with unexpected changes).

The way in which Scrum can be applied to the audit profession is dependent on the length of client engagements and firm size. For larger certified public accounting (CPA) firms with longer-term client engagements (e.g., six months to year around), a single audit will likely have many sprints, one or more for each phase of the audit process. This will allow Scrum teams to not only learn about the client's processes and controls, but to also learn how to conduct the team's sprint activities more effectively. Large firms may have multiple Scrum teams working on the same engagement and will have additional processes to coordinate Scrum teams.

For smaller CPA firms with many short client engagements, the same Scrum team may work on multiple clients during a busy season. An entire audit may consist of only one or two sprints. This will allow Scrum teams to effectively manage activities associated with different clients. These teams will focus on gaining insight into effectively delivering services to clients in a timely manner.

A growing body of empirical evidence demonstrates that incorporating agile project management techniques (e.g., Scrum) can improve performance in more traditional industries and activities, such as education (Loewus 2017), banking (Mahadevan 2017), manufacturing (Rehm 2016), and strategic planning (McFarland 2008). The American Institute of Certified Public Accountants (AICPA) understands that as new technologies and business models disrupt different sectors, businesses and their finance functions need to be agile to adapt and benefit from those changes (AICPA 2017).

The use of Scrum for auditing teams offers a new paradigm that moves from a more rigid and reactive planned auditing focus to a new emphasis on iterative identification of auditing tasks in response to changing conditions. The movement to a more continuous audit via the introduction of advanced data analytics should make the financial statement audit process more, rather than less, dynamic (AICPA 2015). The project-based nature of the audit profession appears to lend itself well to Scrum, and the changes in technology could present an opportunity for firms and researchers to explore Scrum and assess its potential benefits to the audit process.

• Q1:

  What is your position at your accounting firm?

• 1. Audit Partner (1)

  2. Audit Director (2)

  3. Audit Manager (3)

• Q2:

  Which best describes your accounting firm?

• 1. Local (1)

  2. Regional (2)

  3. National (3)

  4. Global (4)

• Q3:

  Our firm's audit process is smooth and predictable.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Highly disagree (5)

• Q4:

  Project management is not a significant issue for our firm's audit engagements.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q5:

  The external audit environment is consistent and predictable.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q6:

  Changes in accounting and auditing standards disrupt our firm's audits.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q7:

  Our firm has adequate resources to take on significant new work.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q8:

  Our firm is adequately prepared for changes in audit technologies.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q9:

  Our firm's audit engagements are earning an acceptable rate of return.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q10:

  Our firm's audit teams are able to effectively handle disruptions (e.g., loss of personnel, client-related issues, time delays).

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q11:

  Our firm's clients pay an acceptable rate for client-related project overruns.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)

• Q12:

  The personnel on our firm's audit teams are performing to their full potential.

• 1. Strongly agree (1)

  2. Somewhat agree (2)

  3. Neither agree nor disagree (3)

  4. Somewhat disagree (4)

  5. Strongly disagree (5)