Agile Auditing - Lanjutan
Agile Auditing - Lanjutan
“Education is the most powerful weapon 2017 – Present 2010 – 2017 2008
which you can use to change the world.” Was appointed as Head of Started as Internal Audit & Entreprise Risk February 2008 – November
- Nelson Mandela Group Internal Audit. Management Coordinator until Sept 2014, and 2008, starting carreer as a
became Head of internal Audit on Oct 2014 until Junior Auditor at KAP Salaki &
Sept 2017. Salaki.
Scan Below :
Agile (big “A”): a noun used to describe the use of specific agile
software development methodologies and an associated mindset shift
to achieve more value and agility from the internal auditing process.
For example, an internal audit function is using Agile software
development approaches to innovate the internal auditing
process in an effort to better address the dynamic risk
environment.
WHAT IS SCRUM?
Scrum Origin
Scrum (n): A framework within which people can address complex adaptive problems, while
productively and creatively delivering products of the highest possible value.
HISTORY AGILE IN INTERNAL AUDITING
AGILE AND THE IPPF
AGILE (SCRUM) INTERNAL AUDIT
7
COMPARISONS
AGILE IA AND
TRADITIONAL
WATERFALL
AUDITING
AGILE MATURITY MODEL
COMMON FEATURES OF AGILE IA THAT DRIVE VALUE INCLUDE
• Focus on value, not audit objectives. While traditional processes focus on defining audit objectives during the planning
phase, Agile IA defines the value to pursue during the audit engagement up front. In this way, the goal of producing value
happens when audit deliverables align with the objectives and strategies of the organization.
• Clients are involved. Audit clients are an integral part of the project team. This allows for more regular interaction between
the audit team and audit client compared to traditional methods, which results in improved, frequent communication
• Time-boxed discipline. During Agile IA, fixed length work cycles are defined. This allows for built in discipline to complete
audit engagements on time.
• Timely insights and responses. Since audit clients are engaged during Agile IA, they receive concurrent feedback and insight
throughout the audit process. Audit insights are not delayed while being validated, as in the traditional approach, so clients
can begin to formulate risk responses immediately.
• Fewer disagreements. Because audit clients are more intimately engaged as an Agile IA engagement progresses, there are
opportunities for audit results to be discussed, mutually vetted, and agreed upon concurrently with the audit team. This
involvement increases the likelihood that audit clients will embrace audit results and take stronger ownership positions
toward responses
• Document rationalization. Simplicity (the art of maximizing the amount of work not done) is a key element in Agile IA. The
focus is to make the audit process more efficient and eliminate unneeded items.
Resource constraints. Agile IA methodology promotes values that create opportunities
to gain efficiency, which in turn can increase available capacity.
Highly complex audit engagements. One reason Agile SD frameworks were originally
designed was to tackle highly complex and ambiguous projects. Agile IA methodology
has similar features that make it suitable for complex audit projects (e.g., iterative
planning and product delivery, time-boxed work increments, close audit/client
collaboration, and adaptability).
Relationship building. Agile IA places high value on collaborative relationships with
audit clients. In an environment where audit clients are providing feedback that is
more constructive than positive (e.g., communication challenges, trouble
understanding issues faced by the business, etc.), an Agile IA approach could help close
BENEFIT AGILE
the gap on some of the common relationship issues faced by internal auditors
Re-branding. Sometimes internal audit functions and their corresponding value
proposition within the organizations they serve grow stale and may lose their edge.
AUDITING When a brand grows stale, a fresh start can recharge and bring new life to the internal
audit activity.
Meet stakeholder expectations. Internal auditing is a service. While professional
standards dictate to a large extent how our service is performed, if stakeholder
expectations are not met, they will look elsewhere to have their needs fulfilled
Optimization of effort. Traditional waterfall auditing approaches are inherently prone
to waste. While Agile IA designed to value lean principles that seek to eliminate waste
and gain efficiency in the audit process.
Specialized knowledge. Agile IA is designed to accommodate the participation of
subject matter expertise on the audit team without the organizational infrastructure
needed to support guest auditor or rotational programs. Having this subject matter
expertise as part of the Agile IA team may also provide internal audit staff with
learning and development opportunities.
VALUE PROPOSITION
• Risk agility. Enable internal audit functions to flexibly deploy resources to support dynamic risk.
• Integrated value-driven insights. Reporting that produces insightful, point-of-view commentaries that are value-driven (i.e.,
integrated with organizational strategies, corresponding risks, and value chains)
• Efficiency. Reduce audit cycle times and resource consumption to increase risk coverage capacity
• Complementary benefits. Return on investment that builds energy to sustain quality and high-value outcomes (e.g., staff
motivation and invigoration, enhanced collaboration, internal audit function brand augmentation, etc.).
Our highest priority is to satisfy the customer through early and Our highest priority is to satisfy the audit committee through
continuous delivery of valuable software. earlier and continuous delivery of Influential audit work.
Welcome changing requirements, even late in development. Agile We welcome in flight change where it will add business value.
processes harness change for the customer’s competitive
advantage.
Deliver working software frequently, from a couple of weeks to a We deliver audits frequently with a preference to avoiding the
couple of months, with a preference to the shorter timescale. delivery of a hockey stick.
Business people and developers must work together daily throughout Auditors and auditees must work together daily throughout the audit
the project. review.
Build projects around motivated individuals. Give them the Build projects around motivated individuals. Give them the
environment and support they need, and trust them to get the job environment and support they need, and trust them to get the job
done. done.
The most efficient and effective method of conveying information The most efficient and effective method of conveying information
to and within a development team is face-to-face conversation. between auditors and auditees is face-to-face conversation.
COMPARATION AGILE MANIFESTO IN SOFTWARE DEVELOPMENT AND IN AUDITING PRACTICES.
Working software is the primary measure of progress. The final audit report is the final measureof
progress.
Agile processes promote sustainable development. The sponsors, Agile processes promote sustainable auditing. The
developers, and users should be able to maintain a constant pace sponsors, auditees, and business should be able to
indefinitely. maintain a constant pace indefinitely.
Continuous attention to technical excellence and good design enhances Continuous attention to technical excellence and good
agility. design assessment enhances agility..
Simplicity – the art of maximising the amount of work not Simplicity – the art of maximising the amount of work
done – is essential. not done – is essential.
The best architectures, requirements and designs emerge from self- The best audit work emerge from self-organising teams.
organising teams.
At regular intervals, the team reflects on how to become more Regularly reflect on the effectiveness of our actions,
effective, then tunes and adjusts its behaviour accordingly. knowledge, tools and techniques (through tollgates and
retrospectives) in order to identify and act on
improvement opportunities.
SHIFTING MINDSET
SUCCESS STORY
Smart
Infrastructure Gas &
power
Digital
Siemens Industries
Mobility
Identification& Preparation … Moving fast but in a ‘scientific' way PilotWavesI – III Scaling Up
• Outside-in-view via benchmarking • Experiment • Establish roles and career model
• Introduction to Agile as the new way of • Inspect and adapt • Quality gates through CoE
working
• Leverage lessons learned from retrospectives • Holistic change management
• Getting inspired by Deloitte’s
• Building Center of Expertise (CoE) • Further refine the role of the CoE
white papers on Agile auditing
• First thoughts on apprenticeship model for • Global deployment of training
Agile Internal Auditing capabilities • Fully Agile by FY 2021
SCHLUMBERGER: OVERVIEW
• Schlumberger is the world's leading provider of technology for reservoir characterization, drilling,
production, and processing to the oil and gas industry.
• For over 90 years, Schlumberger technological innovations have provided value for oil and gas operators
by helping them increase production and recovery from nonrenewable resources.
April
Agile Pilot for Western
Shortened audit life cycle & time to report Hemisphere
Asset Corporate
Management Functions
Information
Technology Distribution
$7.4T
customer 8 locations 5 teams
assets
➢ More timely delivery of higher impact results ➢ More frequent and transparent
engagement with stakeholders
Why Agile?
➢ Improved ability to dynamically manage
audit priorities ➢ Empowered, engaged, happy associates
SCRUM COMPONENTS
Roles
1. Product Owner Artifacts
2. Scrum Master 1. Product Backlog
3. Development Team 2. Sprint Backlog
3. Product Increment
Events
1. Sprint Planning
2. Daily Scrum 3 Pillars for Success!
3. Sprint Review 1. Transparency
4. Sprint Retrospective 2. Inspection
5. Sprint 3. Adaptation
SCRUM PROCESS Taken From :
Microsoft
Audit Program
81
BACKLOG TAXONOMY
Comprise a very global and not very well defined
functionality in your audit
78
KEY ELEMENT – SPRINT PLANNING
User Story
An effective user story is one that considers the risks, complexities, and relevance of the story
There are three key components to a story – the actor, the action and the outcome. Who is the responsible party (actor) for
the key elements of the story,
Changes & Leading Practices :
a) Creating a story that is small enough to be completed within a sprint can be a challenge. Teams often want to bite off more
than what can fit into a one- to two-week sprint.
b) Make sure the story has concrete business value and is testable by itself, after which audit conclusions can be initially
determined.
c) Involve the product owner in understanding requirements and mapping the stories. Continue to stress to your teams that the
initial backlog will not be the final backlog; it’s ok to get started with some unknown
Definition of Ready
Involve the product owner in understanding requirements and mapping the stories. Continue to stress to your teams that the
initial backlog will not be the final backlog; it’s ok to get started with some unknown
Changes & Leading Practices :
a) There needs to be agreement between the scrum team, product owner, and stakeholders that the project can start.
b) DoR should be viewed as the starting line.
KEY ELEMENT – SPRINT PLANNING
Sprints and time-boxing Definition of Done
the user stories are grouped into sprints. Sprints—time-boxed A DoD defines the value to be delivered in a sprint. It can be
intervals in which specific tasks must be completed—provide a expressed as a level of assurance; a list of identified issues,
process, a structure, and a cadence for the work. The time-box risks, or recommendations; or a report or POV.
should provide the motivation of a tight deadline to keep the
teams focused DoD helps define when a story has been completed to the
satisfaction of the audit product owner and meets an objective
Changes & Leading Practices : of an audit. It should not be lengthy or complex or it will likely
not work at the sprint level.
a) People sometimes do a poor job estimating time. Don’t expect
the first sprint to be perfect. Changes & Leading Practices :
b) On IT projects, industry experience indicates that two-week a) Think of a DoD as a checkpoint rather than a destination to
sprints are the norm, even for companies that have tried enable the team to modify or redirect the work as it proceeds.
longer ones. Internal Audit should shoot for one- or two-week
sprints. b) The DoD defines the level of assurance needed or the desired
quality of the final product. Often, low levels of assurance or a
c) Having a dedicated scrum master/ coach is a leading practice. quick review of certain controls is all that’s needed. Other
The “coach” role may be the most important part, as teams times, higher levels of assurance and deeper reviews are
need someone who can facilitate their learning. necessary.
d) Many teams use the first sprint as a “discovery” sprint in order c) As the objective source of assurance, Internal Audit has
to undertake preliminary work, such as defining needed data or significant input into the DoD. The needs of the audit
gathering required information committee and regulators, as well as those of the business,
must be considered.
SPRINT REVIEW AND RETROSPECTIVE Taken From :
Microsoft
82
CLOSING SPRINT Taken From :
Microsoft
• Challenges/leading practices:
a) Final POVs should reflect “what you really think”
and be supported by the facts. It should be tied to
strategy and answer the question “so what?”
b) A final POV is also a condensed understanding of
the area with a summary of relevant insights into
the state of risk and controls within it.
c) The final POV is only as good as the sprint POVs.
Sprint POVs should drive your backlog refinement
process, leading to the final POV.
d) Waiting until the end to share anything with
stakeholders in writing can lead to challenges
with acceptance.
82
FIBONACCI TOOLS
Summary Result
Fibonacci
• Fibonacci numbers estimates 1
through 8 can be brought in to
sprint, this level refinement
usually in result User Story
Sprint User Story Definition of Definition of Start Target Audit Delivered Expended Fibonnaci Risk
Number Done Ready Sprint Release or Business Effort Frequent
Value Card
(Size)
4) Tuned empirically
BURNDOWN CHART
Apa yang dimaksud dengan grafik burndown?
Grafik burndown adalah gambaran visual yang menunjukkan jumlah pekerjaan yang tersisa yang harus dilakukan dalam
sebuah proyek, versus jumlah waktu untuk melakukannya. Ada dua jenis grafik burndown yang berbeda:
• Grafik burndown sprint: mengukur pekerjaan yang tersisa pada satu tugas atau “sprint” tertentu
• Grafik burndown pekerjaan: menilai pekerjaan yang tersisa pada seluruh proyek
Manajemen waktu yang efektif sangat penting untuk setiap proyek yang berhasil. Namun, hanya 28% persen perusahaan
mengatakan bahwa mereka secara konsisten menggunakan teknik seperti ini untuk mengukur kinerja. Ketidakefisienan ini
berakibat pada 9,9% dari setiap dolar yang terbuang karena kinerja proyek yang buruk. itu artinya $99 juta untuk setiap
$1 miliar yang diinvestasikan.
a. the blue line shows the ideal scenario if your team performs exactly as
predicted by your task estimates and the red line shows the actual
performance. At day 0 (the first day of the iteration), the remaining
effort is at its highest because nothing has been completed. At the end
of the iteration (day 20), the sum should be 0 because there are no
tasks left to be completed.
b. The red line (your team’s actual performance) to be close to the blue
line. When it is above the blue line, then your team is behind schedule
and when it is below the blue line, your team is ahead of schedule.
a. Chart showing areas above the blue line as being behind schedule
and below the blue line as being ahead of schedule
b. If the actual remaining effort line is above the blue line for an
extended period, then it means adjustments have to be made to
the project. This could mean dropping a task, assigning additional
resources, or working late, all of which can be unpleasant but
because of the burn down chart, at least you can deal with it
sooner rather than just before a deadline.
ISSUES LOG
• Estimating task time: This should be for an average team member (not you), and should have team consensus when possible. I
generally estimate at an accuracy of 0.25 days so that simple tasks do not get excluded.
• Prioritizing: Prioritize each task in groups of 10. The highest priority is 10, 20 is lower, 30 is lower still, etc. Incrementing by
10 seems like an odd choice at first but it is likely that some tasks have been missed or need to be split so having a second
digit available is handy for task insertions.
Iteration
• Efficiency Factor :
a) This is a measure of your team productivity and task estimate
accuracy. Use 0.7 as a starting point but after the first
iteration, you will be able to obtain an updated value from
the spreadsheet. It is calculated based on the following
formula.
b) Based on past performance, the efficiency factor adjusts the
effective number of days available to work on a project so
that your estimates become more in line with reality. This
eliminates problems with consistent under estimates or over
• m – Ideal Remaining Effort : Slope for an ideal iteration(see burn down estimates.
chart) -(# of task work days)/(Work Days) c) It is possible to have an efficiency factor greater than 1. This
means that your time predictions are greater than how long it
• b - Ideal Remaining Effort : Intercept for an ideal iteration – This should equal actually takes to perform a task. This does not require any
“Effective Man Days” special consideration.
• m - Man Days Used : Slope for calculating the number of Man Days used per • Work Day : The number of work days between Start Date
day – This will be used later for updating the efficiency factor after an
and End Date – For software development, 20 is
iteration
a good starting point which is one month (5
• Effective Man Days : The amount of time that is available for actually working working days a week for 4 weeks).
on tasks.
Simple boards have columns for "waiting", "in progress" and "completed" or "to-do", "doing", and "done".
Complex Kanban boards can be created that subdivide "in progress" work into multiple columns to visualise
the flow of work across a whole value stream map.
KANBAN
Completeness
and Verified
Master Data
Accuracy of
Payment
KANBAN
Completeness
and Verified
Master Data
Accuracy of
Payment
KANBAN
Accuracy of
Payment
Incident
Response
KANBAN
Accuracy of
Payment
Incident
Response
KANBAN
Accuracy of
Payment
Incident
Response
KANBAN
Accuracy of
Payment
Incident
Response
KANBAN
Accuracy of
Payment
Incident
Response
GREAT THINGS NEVER CAME FROM COMFORT
ZONES
“UNKNOWN”
SCRUM EXERCISE
Sebagai Auditor PT International anda Diminta untuk melakukan Audit Prosess Infrastructure dimana
manjemen bertujuan meyakinkan agar optimalisasi Governance Dalam Project Infrastructure dapat
memberikan nilai tinggi pada pekerjaan yang dilakukan.
Beberapa point yang menjadi concern dalam audit ini adalah :
1. Optimalisasi proses Budget agar budget yang dibuat relevan dengan pekerjaan yang ada, tentunya
dengan memfokuskan kepada point-point dibawah ini :
A. Akurasi Budget based on aktual market
B. Controlling efektifitas budgetin
2. Manajemen juga ingin menguji kehandalan sistem Procurement Perusahaan dengan bertujuan, untuk :
A. Mendapat barang yang kualitas tinggi
B. Vendor yang dipilih adalah vendor yang capable dan berkualitas
C. Proses procurement Terhindar dari Tindakan fraud
3. Dalam proses review dan control terdapat proses monitoring yang cukup sehingga tidak terjadi
keterlambatan proyek dengan mengacu kepada beberapa point yang di fokuskan sbb :
A. Kapabilitas tenaga kerja yang terlibat dalam proyek ini
B. Penurunan atau Eliminasi pekerjaan error
SCRUM EXERCISE
Sebagai Auditor PT Nasional anda Diminta untuk melakukan Audit Prosess Human Resources dimana
manjemen bertujuan meyakinkan agar Perusahaan memiliku sumber daya yang handal dan dapat
membantu perkembangan Bisnis Perusahaan
Hal yang menjadi focus bagi manajemen dalam audit ini adalah beberapa point terlampir yaitu sebagai
berikut :
1. Bagaimana Bagian Human Resources dapat Memastikan proses rekrutmen berjalan secara Efektif
dengan mefokuskan kepada point :
A. Recruitment dilakukan secara tepat waktu
B. Karyawan yang di rekrut sesuai dengan yang dibutuhkan Perusahaan
2. Bagaimana HR dapat menguatkan sumber daya dengan program pengembangan yang terstruktur
dengan focus kepada
A. Kompetensi tenaga kerja sesuai dengan kebutuhan industri
B. Program pelatihan sesuai dengan program pengembangan perusahaan
3. Bagaimana HR melakukan pengelolaan karyawan yang resign atau pension dengan baik dengan
mengacu kepada :
A. Proses Retirement sesuai dengan UU yang berlaku
B. Program pembinaan karyawan yang pension dilakukan sesuai dengan minat karyawan
SCRUM EXERCISE