Annotated Bibliography & Problem Statement

Agile_Governance_and_Audit_An_Overview_for_Auditor..._----_Chapter_3_Why_Doesnt_My_Auditor_Agile_Project_Team_Understand_Me_.pdf

Home >Business & Finance homework help >Operations Management homework help >Annotated Bibliography & Problem Statement

CHAPTER 3: WHY DOESN’T MY AUDITOR/AGILE

PROJECT TEAM UNDERSTAND ME?

Overview

I can be rude about auditors – I am one. As a Certified

ScrumMaster I can also be rude about Agile project teams.

Having been in meetings where both of these tribes meet, it

strikes me that there can be mistrust and a lot of

misunderstanding between the two. In this chapter we will

consider:

 audit and Agile cultures.

 how can we have a successful audit?

 Conclusion.

Audit and Agile cultures

The overall purpose of a project audit, including Agile

project audits, is to provide independent assurance to

management that:

 the project is being run with appropriate governance to mitigate the risk of cost or time overruns or failure to

meet the project’s objectives/key stakeholder needs.

 the deliverable will include adequate controls to ensure the accuracy and completeness of processing.

These aims should also be shared by the project team.

Many organisations operate a ‘Three lines of defence’

approach to their enterprise risk management. This is

summarised in the following table together with how these

may be represented on an Agile project:

Wright, Christopher. Agile Governance and Audit : An Overview for Auditors and Agile Teams, IT Governance Ltd, 2014. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/harrisburg-ebooks/detail.action?docID=1778767. Created from harrisburg-ebooks on 2020-11-16 07:33:50.

C o p yr

ig h t ©

2 0 1 4 . IT

G o ve

rn a n ce

L td

. A

ll ri g h ts

r e se

rv e d .

3: Why Doesn’t My Auditor/Agile Project Team

Understand Me?

Line of

defence Responsibility

Agile project

approach role

Agile

deliverable role

1: Business

operations

Risks are

identified and

controls

designed to

mitigate them

Project or Scrum

team

Project or Scrum

team –

stakeholder

representative.

2: Oversight

function

Review to

ensure control

arrangements

are in

accordance with

organisation

policies and

other standards

Information risk

management or

governance, risk

and control

(GRC) team

Business’

governance, risk

and control

(GRC) team.

3: Independent

assurance

providers

Provide

independent,

objective

assurance

Internal audit. Internal audit.

The anthropologist Edward T Hall developed a theory of

high and low cultures to explain some of the issues that

different groups have in communicating with one another.

High-context cultures:

 relational, collectivist, intuitive and contemplative

 emphasise interpersonal relationships

 need to first develop trust

 prefer group harmony

 words less important than context

Low-context cultures:

 logical, linear, individualistic and action orientated

 value logic, facts and directness

C o p yr

ig h t ©

2 0 1 4 . IT

G o ve

rn a n ce

L td

. A

ll ri g h ts

r e se

rv e d .

3: Why Doesn’t My Auditor/Agile Project Team

Understand Me?

 solve problems by structured analysis

 discussions end with actions, often contractual

 use precise language

There are two things that strike me most about this:

1. Most of the auditors I know are primarily low-context

culture types. They like accuracy, precision and

certainty. They prefer evidence and documentation to

harmony and interpersonal trust. Most Agile project

teams prefer consensus and agreement and are focused

on achieving a goal.

2. The Agile Manifesto we saw in Chapter 1 reflects this

cultural split. Generally Agile favours the high-context

cultural issues rather than the low.

This presents some interesting challenges for auditors and

project teams to work together. Both should have the same

objective – to develop and implement a product with low

risks and effective and efficient controls. The auditor

should also not forget the specific risks associated with

Agile described in the previous chapter. For an audit to be

successful it needs to be seen as a team effort combining

both the auditor and the auditee. This requires trust and

understanding, right from the early stages of the audit.

There is a risk of a cultural imbalance on a project, leading to

misunderstandings and poor communication of expectations.

On one project I worked on testing was to be performed off-

shore. Test scripts had been written on-shore and were vague

and lacking in detail. The test writers had assumed the testers

would have sufficient understanding of the objectives behind

the tests and so would be able to complete them satisfactorily.

However, the off-shore team was unable to do this and so just

failed the tests. Eventually all the test scripts had to be rewritten

C o p yr

ig h t ©

2 0 1 4 . IT

G o ve

rn a n ce

L td

. A

ll ri g h ts

r e se

rv e d .

3: Why Doesn’t My Auditor/Agile Project Team

Understand Me?

and testing performed by a new team, leading to significant

delays in the project. Management needs to ensure these

potential cultural conflicts are discovered early and corrective

action taken as necessary. If the project exhibits the Agile

features we saw in the last chapter – in particular transparency,

inspection and adaptability – such cultural issues should not be

a major problem. This will help to avoid the risks of

misunderstandings arising between auditors and Agile teams.

I have worked on projects where the project team was

based in many locations and from different organisations.

In my experience good communication and mutual respect

can overcome most cultural boundaries, including those

between auditors and Agile teams.

Agile works best where the project team has developed its

own culture that works for them as a team. For example,

where the project team is located in different offices, or even

countries, this may include the use of videoconferencing and

instant messaging to develop a common team culture and

awareness. Some organisations also include HR change

management techniques when developing Agile teams; for

example, the use of Neuro-linguistic programming (NLP) to

improve the understanding of team members of the

behaviour patterns of other team members. The use of a team

charter can also be beneficial. In Scrum, for example, it is

common to see these including the five values of Scrum:

1. commitment to the shared goal or outcome of the project.

2. focus on the task and deliverable.

3. openness – promoting transparency.

4. respect for all team members (and stakeholders).

5. courage to commit to the project and share views with

others.

C o p yr

ig h t ©

2 0 1 4 . IT

G o ve

rn a n ce

L td

. A

ll ri g h ts

r e se

rv e d .

3: Why Doesn’t My Auditor/Agile Project Team

Understand Me?

Each team will present these values in a charter, and any

new members of the team will be expected to work within

the team using the charter as a basis. In this way the team

becomes self-policing – for example, managing situations

where individuals are failing to work to the standards

expected and are therefore letting down other team

members.

How can we have a successful audit?

A traditional approach to an audit would be to review a

project, usually after it has been completed, and examine all

the documentation. The auditor may work to a specific

checklist of questions and will provide findings and

recommendations. Given the cultural context we reviewed

earlier, most project teams would not be comfortable with

this approach – it seems to demonstrate a lack of trust.

There could also be difficulties in that the project team may

have moved on to other projects or deliverables. Any

recommendations relating to governance may be

incorporated in future projects. However, if the findings

relate to project controls, it may be too late to make a

change – and also expensive since a change process would

have to be triggered. My top key tips are therefore:

 For high risk/significant projects audit should become involved from early in the project. It may also be

beneficial to review a number of projects concurrently so

that the auditor can identify and communicate examples

of best practice.

 Using Agile culture, the audit team should ensure all project team members are aware of the audit, the

need for the audit, how it will be reported and next steps.

C o p yr

ig h t ©

2 0 1 4 . IT

G o ve

rn a n ce

L td

. A

ll ri g h ts

r e se

rv e d .

3: Why Doesn’t My Auditor/Agile Project Team

Understand Me?

I have used ‘lunch and learn’-type sessions very

effectively for this in the past.

Conclusion

It is possible for auditors and Agile teams to work together

to achieve a well controlled product and a well governed

project. The auditor can remain independent but does need

to work collaboratively with the project team.

C o p yr

ig h t ©

2 0 1 4 . IT

G o ve

rn a n ce

L td

. A

ll ri g h ts

r e se

rv e d .