Loading summary
A
So when it comes to agility, especially an internal audit, we are starting to see a shift from a methodology focus of here's the steps, follow the steps to more of a mindset.
B
Hello everybody. Welcome to another episode of the Audit podcast. I'm your host, Trent Russell and today, backed by popular demand and multiple requests, Clarissa Lucas. Clarissa is the author of Beyond Agile Auditing. In my opinion, the go to book for all things audit and agility. You may have seen her at various conferences, webinars, podcasts. So relative to auditing with agility, we talk about, is that a mindset thing or is a methodology thing? I know a lot of teams that we work with who use auditing with agility. It still comes down to the practices like these are the things that we have to do every day as opposed to the mindset of this is why we should be doing this, as a way to put it. And so we definitely want to hit on that. So for those teams that are taking the practice first approach or the methodology approach, what can they do to get to the Agile mindset, which is, as Clarissa explained, significantly more important? But with that said, there are certain practices that are extremely helpful, especially when understanding why they are helpful. And so we did want to get Clarissa's like, hey, what's the 8020 on practices that we should implement? And then go into detail about how we should implement those. And then there's an annual research paper that comes out on agile that Clarissa took and she translated it into our audit language and then further speaks on again, which practices make a lot of sense. Mindset versus methodology. So some research that backs what Clarissa has seen in the field from the clients that she's worked with and the other agile experts that she's talking to. And then selfishly, I have a client who is a full time data analyst and again at times get pulled into up to four stand ups a day. And so I don't know how many other people can empathize with that, but I'm sure there's still lessons learned from it. So anyway, again, selfishly, I just wanted some free consulting advice from Clarissa and so we hit her up on that question. With that said, here we go. So Clarissa, what's your. Could you give us an example of a prompt that you use maybe for work? And then also one more. So like in your personal life?
A
Absolutely. Before I do, I just need to give a quick disclaimer. Uh, the views and opinions expressed here are solely my own and do not reflect those of my employer. So now that we have the Formalities out of the way. Let's have some fun. Uh, the professional. My favorite professional prompt or use case, I'll say because I'm still refining my prompting skills as I'm sure a lot of people are. So I haven't really figured that out a hundred percent, still refining it. But my favorite use case so far has been using Gen AI to help me prepare for professional speaking engagements both, you know, in my. In. In my outside business, just as an agility, thought leader and speaker, as well as in a corporate role that I hold. So I use it to create training materials, specifically use case studies. I think case studies really help bring material to life for people, make it really relatable. So I'll just throw some prompts into some Gen AI and ask it to create a case study. I give it some context as like it's an internal audit shop at a financial services organization or a manufacturing organization or whatever that intended audience is going to be. Give it some details with the problem that you know, the, the people in the case study are trying to solve through and, and have it build a case study. It usually takes some refining. Like I said, I'm working on my prompt engineering skills, but it'll take some refining and then I get the case study to where I'm satisfied with it. I don't stop there though because you know, you and I caught up offline and trying to think about like what can we delegate to Gen AI that we just don't have the capacity for. So not only is it helpful to create the case study, but I also have it create the answer guide. So as I'm facilitating these discussions and workshops and things like that, I like to have, you know, for myself or if I'm delegating this to others on a, on a team, here's the key points that we want people to cover when they discuss this. So thank you. Janaya. Yes, I'm a thank you and a please person. I know that's kind of a highly debated topic, but thank you for that. Now can you please create an answer guide for the facilitator highlighting the. The key takeaways and responses to the questions within the case study. So that's, that's a very common use.
B
Case for me on the prompting front. Now that you likely have enough examples to do that. That's still probably one of the best ways to better prompt is to give it the examples and go like here's all the examples, even not just the content but even the way you want it formatted. All that kind of good stuff. So examples help and then depending on how many, how long you have basically to sit there and let it think on itself or I'm going to put think in air quotes because definitely not thinking when it's done or at the end of your prompt say, okay, now check your work 10 different times or 200 different times or whatever it is. And it takes longer for it to give you the answer, but it just kind of goes over itself and loops multiple times. So I found that to be helpful.
A
I love that. Thank you. Something. Well, before I move to the personal, sorry, I, I kind of have an ask and I don't know, you know, if, if you have the answer to this or if the listener an answer to this. But I want to kind of take that professional use case one one step further. I would love to be able to use AI to create animated videos for those training sessions or for my website or things like that, just to kind of take those case studies and it'll say like Jan did this and then they talked to Steve. And I would just love like even stick figures animated with kind of the, the voiceover and things like that. But I, I know there's a lot of tools out there that say that they can do that, but none of the free versions do. And before I invest in something, I love recommendations. So question out there for listeners if there's any recommendations that you have. You've done this before, you've created super simple videos using Gen AI. Which tool or tools would you recommend and why? Is is kind of my ask of listeners.
B
Got it. And I think if, depending on the timing of when we publish this, maybe it will be out. But Sora s O R A2 is the one from ChatGPT. I don't do a ton of, well, I don't do any of the video stuff. I mean even some of the examples, I've seen you look at it and go that's incredible, I should probably play with that. And I go, I just, I don't really have like a use case for videos right now. But Sora 2, I am sure that it's part of the paid version of ChatGPT, which is 20, 22 bucks, something like that. But I've seen some really cool stuff with that one so far. And the reason I say depending on the date of publishing right now it's invite only to get access to it, but eventually they'll roll it out to everybody, so.
A
Excellent. Well, I will probably have this need for a long time, so it's okay if it's not immediately available to me, so I appreciate that.
B
Got it. All right, Personal. These are the, these are the more fun ones. The professional stuff's like, yeah, that's great. No offense. I mean, they, Everybody has their own.
A
Oh, I get excited about them. But yeah, I know the personal. And here's a vulnerable moment for me is this is probably embarrassing, but it's real life math homework. And I'm not talking my own. I'm talking about my middle schoolers. My son comes home from school with math homework and he's in middle school, so I should be able to explain these concepts. Spoiler alert. I was a math major in undergrad.
B
Yikes. Okay.
A
Um, yeah, so my professors, if they.
B
Listen to this, are probably going to.
A
Be very, very disappointed in me. But to be perfectly honest, by the time he gets home from school, I've put in, you know, more than a full day of work. My brain is fried. I don't know if it's just the mental load from work or if this is just 40 and this is how my brain is just functioning from now on. But I, I definitely need help. The concepts that he's. He's working on make sense, but I just look at the problems that I'm like, I. I need some help with this. So I will Type it into ChatGPT is the one that I use. Somebody also told me the other day when I was giving this example that I could just take a picture of the problem and upload that to Chat GPT, which saves me even more time. Thank you for that. And then I just ask it, you know, can you please solve this and give me step by step instructions on how to solve it. So it helps me kind of prompt my son on like, okay, what about, you know, what does this number tell you? Or something like that so that he can actually know how to figure it out. But, oh, my gosh, that's been a lifesaver. Well, I know you're not embarrassing, but very useful.
B
I know the CAE and listener of the show, so I don't know if he's going to hear this, but he had the exact same use case and it was. So the first version of ChatGPT was not good at math, so you couldn't really do that. And that's kind of where we started talking about the different models and things. But certainly now, as you very well know, that is possible. Yeah. Did not see the former math major needing help with. With middle school math homework.
A
It. It's a thing. It's like those unused Skills, you learn something, but if you don't use it on a regular basis, you lose it. It's been a long time since I've. Since I've been an undergrad. So, yeah, I've lost a lot of those skills.
B
That's a good point. It's. We had it today. So we have this roundtable of audit analytics managers and folks like that, and we were talking about upskilling and all this kind of stuff and made the point that regardless of the program that you put together to, like, upskill the team, they have to stay in the tool pretty consistently because if they don't use it, they will lose it. So, anyway, that's very top of mind. It seemed like everybody on the call had some kind of feedback on upskilling, because I think literally everybody, well, to some degree, everybody has to train to get better at something, but usually we hear about it in the DA context, so. Okay, hey, everybody. We're going to take a quick break from our guests. And if you need to get analytics or AI actually working in your internal audit department, or if you already have some of it, you feel like you're not really getting exactly what you need out of it, you know, there's more you're not getting that. Go to the show Notes, look for the Green Skies analytics link. Click it on the website. There'll be other links that you can click that'll take you directly to a calendar to schedule time. It's literally three clicks to get the time scheduled to get it figured out. All right, back to the show. Agile, or do I call it auditing with agility? I feel like when I say agile.
A
With you, you're always like, nope, I know, I know. And we can. We can get into some of the nuances with that, too.
B
All right, question I have for you is, is it about the mindset of working with agility? I will put it that way. Or is it more methodology and practices and follow it, but follows the practices, basically, that I think most people who have ever taken a dive into it are familiar with.
A
Yeah. So I'm going to ask a couple of questions of you, and I know that, you know, I'm not the host today. You're the host, so you're supposed to be the one asking the questions. But I am going to. I'm an auditor. You can't turn the questioning off of me. So when it comes to agility, especially an internal audit, we are starting to see a shift from a methodology focus. Here's the steps. Follow the steps to more of A mindset. So let's, let's talk about what I mean by that when I say the word agile. What comes to mind for you?
B
Kanban boards.
A
Kanban board. So like a thing, right? That's fair. That's usually, that's that or sprints or standups or those types of things are usually what come to mind for people. But when we look at the definition, Agile just means the ability to respond, to change, the ability to move quickly or to be adaptable. Agile is actually an adjective. And I know we just talked about me being a former math major, I wasn't an English major, and I'm not going to go into a grammar lesson here because I would totally need to get some AI to help me with that. But bear with me. So agile is an adjective, it's not a noun. So because it's an adjective, it's not a thing. Like a noun is a person, a place, or a thing. It's not that it describes a thing in the context of auditing, it just describes how we audit. So, but why do we think. Kanban board. Why do we think about the things? Because back in 2017, I'll say, you know, give or take a year or two, either way. But 2017 is really when Agile was presented to us as auditors and it was really presented to us like a noun thing, a methodology. So as a profession, we pursued the thing, which is typically a scrum or agile methodology. Our attentions were good. We intended to be more flexible, more nimble, more adaptable, or dare I say, more agile. But because we focus so much on those things, the sprints, the standups, the Kanbans, we lost sight of that underlying intention. But if we think about it, Agile just describes a way of doing what we do. We audit flexibly, we audit adaptively, we audit agilely. I struggle with that, with that pronunciation. But, you know, so it's, it's really just a way of thinking or a mindset. And that's one that we can achieve through things like sprints, feedback loops, Kanban boards, or other practices. But really at its core, it's a way of thinking. But the good news is that, you know, there was a point to all of that grammar lesson. The really good news is that we're starting to see a shift from methodology to mindset organizations that went practices first, so they went sprints first or Kanban first or whatever those practices were. They're starting to see the need to instill more of a mindset to truly get those benefits that they were looking for. In the first place. And for me this is super exciting because when we focus on that mindset, really going to start seeing organizations really focus their work on what's most valuable and adapt to that rapidly evolving landscape that we're all operating in.
B
For the ones that are still doing the thing or the noun and aren't doing the adjective or there's so the other way of saying there's still methodology and practices instead of mindset. What can they do to change to the mindset? And the reason I ask that is a lot of times on the show even we'll ask whatever, I don't know, whatever the question is. And somebody goes oh, that's a mindset thing. And I go, that's not easy to change. You know, it's not like taking a training to change your mindset. And to the extent that I know and answer my own question, because you're asking me questions. And so as the host I'm going to ask my own question. James Clear, who wrote Atomic Habits, had this quote and I forget how the whole thing went, but he basically said that books are how he changes his mindset. And I thought about it and I went that's. That works for me really well also. But for those that aren't going to read the books, maybe how can they change their mindset?
A
I think the most simple way to think about it is that you really need to anchor back to your why. And I do want to put a caveat out there. Those organizations that started practices first, they might be seeing a lot of great progress and it might be because that they have that mindset that's supported by those practices. So there's nothing wrong with using an Agile framework or a Scrum framework in my personal opinion. We just have to make sure that we have the mindset that's to supposed supports that we're not just doing the things to do the things, we're doing them for a particular reason, which is, you know, your why. So think back to why do we want to. Why do we want to in, in your example use Kanban boards. A lot of it is so that we can see the work that we're, that we have on our plates. We can easy more easily prioritize the work. We can make sure that we're focused on what really adds value. Same thing with sprints and, and other practices. You just really need to think back to where why are we implementing these and really start with that. And so asking the question why do we want to be agile? In most cases it's so that we can deliver value or deliver value through assurance or advice from an internal audit perspective. And today to be able to do that, not just today, but also tomorrow, we've got to be able to adapt to changes rapidly. And if we have this as our guiding light, which by the way is my, was my go to soap opera back in the day, keeping that as our guiding light, we can implement practices that help us achieve that objective. So anchor to your why, keep that in mind, have that as your foundation and then think about what practices will help support that. Just giving quick advice. If you had one practice to start with, it would be feedback loops, early and often.
B
Okay. The anchoring into the why is that something that maybe as part of the feedback loops, that's where you can instill that mindset is during the feedback loops or retrospectives that you have. Almost like the why as a question also. So there is something that it's not always top of mind, but more top of mind. Is that a, is that a maybe practical way of changing the mindset?
A
Yeah. So I would, I would have you question why are you doing a. In the example of a retrospective review, why do we have retros? So one of the things if you, if you go practice this first and you don't have a mindset to support that is you'll be doing retros and you'll say yep, I did one or I did a couple, but. But what are you actually getting from that? So the purpose, the why behind a retro is to reflect and think about how you might things differently going forward or what are the things that are working really well right now that you want to make sure you carry forward. So if you keep that in mind as you execute a retrospective review or feedback loop. Feedback loop is kind of. It's similar to a retro, but it's looking at what it is you're doing. So we're looking at the scope of the audit as we're, as we're building that or we're looking at the use case for an analytic tool or for a gen AI tool. We're going to use those feedback loops. Why are we using them? To make sure that we are developing that product or developing that scope in alignment with what is going to meet our end user needs in the terms of an audit. That's our stakeholders, that's management, the board, all of our stakeholders, internal and external. When it's a product like an analytic or a gen tool, it's those end users of it. So using. We're not just doing feedback loops to do them. We want to make sure we're anchored back on that why, which is really going to help instill that mindset.
B
So you mentioned feedback loops. I definitely want to come back and see what are the other practices that you're still going like, hey, still, these are the ones that we recommend kind of the most. But I was curious, how did you realize that the practices first way didn't work? Is there a specific example or story that you could share or was it just kind of an aggregation of all these that you've seen, or was it part of a feedback loop or retrospective even that you picked up on this?
A
Yeah, I love that the practices could have delivered the information to pivot and make a decision. In my own journey, I love how, I love how you put those together. So, yeah, in my own journey, I did start practices first. I was with everyone else when I believe it was the GAM stage that I had a chief auditor come back from and was like, oh, agile auditing, we're going to do this. I was all on board, didn't know what it was, so figured it out. It's scrum, it's standups, it's kanban board. So started doing that and had some really awesome quick wins with that. We delivered audit reports sooner, we covered more risks than we had in previous years. We had more effective collaboration with our stakeholders. So always great. But when I started losing sight of the why and I started focusing on doing the things and perfecting the things, that success started to fade. So I keep saying, like, we need to focus on the why. And that's, that's definitely a theme that I want to make sure that I reiterate until everybody in the world knows it. I also want to point out that there wasn't anything wrong with the things. There wasn't anything wrong with the sprints or the standups, the boards, the ceremonies. Where I went wrong was that I focused on the wrong things. It became very mechanical. So I started measuring success with outputs like the number of audits that we did in sprints, or the number of people we trained, the number of tasks we completed each week. But when I reflected on those things as measures of success, I think about my stakeholders as an auditor and the audit committee and senior management. They honestly don't care about that. Like, yes, those are data points, but that's not in the objective of internal audit. To deliver audit reports or to train a certain number of people or to do audits in sprints. You know, my stakeholders weren't going to reach out to me and ask for my advice because I achieved those things. So that was really my aha moment or one of. I feel like I had a lot of them in the process but that was a key one for me. So after that I really started anchoring back to the why and measuring progress in terms of that. So instead of do measuring the things it's let's measure progress in terms of the why and then with that more sustainable success followed.
B
Okay the follow up to that then I know when we've used it with clients before we could see like the burn down rate. So we could see we have this. I think we started with three weeks sprints and then inevitably the first two weeks is like nothing got done. And then the last week you just see like everything started like you know, get done. And so we changed that and went well let's do. It wasn't full five days, it was like seven work business days or something like that. Because I think they felt the pressure a little bit more to go like okay, this is a tighter timeline. So are there some Data points or KPIs or anything to that point that you found that are and let's just say one, if there's one that you could recommend, what would that be? I feel like measuring the why can be difficult.
A
So there's, there's a couple things I want to, I want to pull the thread on there. The first one is and you might have to remind me of the question about the KPI because I got distracted by, by this is a lot of times when we, that the work is kind of snowballing at the end or you know, we're not seeing progress, not seeing progress and then you all of a sudden see a lot of progress. It'd be a great time to perform a retrospective review and find out why, what's driving that, what can be done differently to avoid that. And one of the, one of the practices, so pivoting to another practice that can help with that is limiting your work in progress and breaking your work down into more granular tasks. So if you think about a typical audit, you've got X number of controls that, that you're testing and it, it may take, it's hard to estimate. You know, of course we all come up with estimates. It's going to take 30 hours to test this control. But if you break it down into how much will it take to do a walkthrough of the control you there you usually have to walk through to understand the control. You evaluate the design of the control, you get your population for your operating effect effectiveness test. You test some of those, review the results. If you can break down that control or task. So I'm just using control as an example, but this, you can use this with any type of task. If you can break it down into more granular subtasks, then you'll start to see more progress and you'll be able to start to see where you, as a, as a leader need to jump in and help. So you might say, and if you think about it from. If you're responsible for reviewing work, it's pretty challenging when you get all of the work papers at the end of the audit to review. That's a lot of work at once. It's a lot of pressure. And when the reviewer reviews work, sometimes that's where you identify more chat more issues. So you want to be able to spread that out and do that earlier in the process. So breaking down either the control or whatever the big task is and have people turn their work in in a more granular fashion gets it through those reviews sooner and also prevents some of that landslide at the end. So I know that was a bit of a tangent, but I really wanted to pull on that thread because what you just described is not uncommon with audit teams. And that's something that I would definitely recommend is making the work more granular. And I mentioned something called limiting work in progress. So that means I don't have this whole control in progress. I have the DEI or the, the design of operating effectiveness that is in process. And I get that to a point where I'm either done with it or I have a question out to a stakeholder and then I put it down and then I'm going to go to another task and that could be a different design effectiveness test. So I'm going to do that. And so that prevents me from having to switch back and forth. We know that we lose a lot of our brain power and mental capac when we're switching and multitasking and everything. So it helps reduce that mental load, but also helps get things through sooner.
B
Yep. I know in, in the book also you talk about context switching, I believe. Yeah, I've always been a big fan of that, just from the even replying to emails. I try to block off just, you know, the hour and just knock out emails and then be done with that. So anyway, I'm a huge fan of that. Also the idea of batching things together and so there's not as much context switching. That's why as soon as I would get any new laptop or whatever, work at a new organization immediately. I turned off email notifications because as soon as I saw that email notification, things just went to hell. So, okay, even if you don't click.
A
On it, you're distracted by it. Right. And you're automatically thinking about that as opposed to whatever it was that I was trying to do in the first place. As far as a KPI, it's going to be. It's going to be. And this is probably the. The not the answer that everyone was looking for. I wish it was a real quick answer, but think about your why. If it's. I want to be able to make sure that I'm focused on work that matters to the organization or covering the risks that matter to the organization. Make sure you're measuring that. So it could be, how much time do we spend on the top risks? How many lower risks did we cut out? Are we aligning our depth of coverage with the types of the higher risks? So really just making sure that whatever those KPIs are that you choose, it is aligned with that. Why? Because as the old phrase goes, what gets measured gets the On.
B
Yep. Okay, I think that's perfect. So there's. There's no silver bullet. Hey, if you're hoping to get. If you're listening, like, oh, I just need to get the answer to this a KPI thing, and then I'm getting out of here. And that's exactly what I'm.
A
If there was, I'd be. I'd be doing this podcast from like a yacht in. From some exotic island, which I am not. So. But as soon as I figure it out, I will let you know.
B
Okay, well, I know people are curious to know those practices that you are sticking with. So you mentioned feedback. What are some of the other ones that you feel like people should maybe go? Like, these are the ones. If you're gonna focus, maybe not focus on practices, but if you're gonna implement some of this, this is a good place to start.
A
Yeah. So I, I'm gonna. I'm gonna double down on feedback loops and I can explain a little bit more about what I mean by that, because no matter where you look or Google, you might get some different definitions. So what a feedback loop is, is essentially a way of gathering information or feedback, considering that information and then adapting as you see fit. So that's. It's a very general definition, but I love it because you can apply it in probably any situation. I would say all situations, but I don't want to be held to that, because somebody will come up with a, with a counter example. But if you think about the applicability of it, audit scoping, refining your audit results, building content, project management, building an AI product, performance management. Like I could go on and on, but there are so many different use cases, regardless of whether, whether you're an auditing or you're not at auditing, regardless of whether you are the chief audit executive or an intern or anywhere in between. And I know that's, that's one of the glory pieces of your listener base is this is applicable to anyone. And so feedback loops are really what I would double down on. So let me paint a little bit of a picture. If you're building, let's say an analytic or an AI product, you're not going to just get the request, go back to your desk, build the whole thing and then send it to the end user. We've probably all done that at one point in our careers or something like that. And what happens is we deliver something. We might get super lucky and deliver something that actually meets the user's needs, but more likely what's going to happen is we're delivering something that doesn't meet their needs. And we've invested all sorts of time into creating, creating that. So where feedback loops come in is you're going to solicit feedback, consider that feedback, and then use that information to either change course or double down on your course as you build it. So you might start with like a sketch. And literally I've got sketches in my notebook, not an artist, but they're, and they're pretty hilarious. But like, this is what I was picturing. Is this what you had in mind? We've used this when building data visualizations. I've used it when creating slide decks for stakeholders. Like, is this literally, is this what you had in mind? Getting that feedback and either saying like, yep, that's, that's exactly what it was. So I can go forward or. No, totally off base. I was actually picturing something like this. You get that feedback, you adjust, and then you go to whatever the next iteration is. So maybe then it's a, it's a modified sketch or a prototype or, you know, whatever that draft is, keep iterating with those feedback loops. So by the time you get to that end result that you deliver to your end users, it's usable, it meets their needs, it meets, meets their vision. And so really you might be thinking that's a lot more time. It's really not that much time that you're investing but you're investing it up front rather than at the end. And having to start over again might.
B
Feel like it up front, but then as you do it more and more, you'll realize, oh, we're just correcting mistakes basically before they happen.
A
Absolutely. So you're, you're going to invest the time, so you might as well at least get some checks built in. And it doesn't take long to ask for that feedback either. It's not like it's a three hour session, especially when you have them incrementally, like literally sketch on a napkin. Trent, does this picture kind of look like what you were looking for as far as how to visualize the data? Yep. Okay, great. Like, that was super quick. So it's not a feedback loop. Isn't this big thing that you have to do. It's very simple and it's very rewarding.
B
Feedback loops. What else we got?
A
I'll, I'll, I'll go with the breaking down your work into smaller batches. So I, you know, I know you talked about your, you've got your time that you set aside to go through emails. We, we sometimes can't always set aside a lot of time to do things. So as long as we can batch those, those, patch batch that time and focus on certain things during the that period of time. That's very helpful to reduce the context switching. So really break down your tasks into not so granular that it's like, click here, click there. It's got to be meaningful subtasks. But breaking it down into a way that reduces the amount of context switching allows you to focus mentally on that and reduce the mental load and produce quality work that's packageable and usable by somebody else.
B
All right, so maybe outside of this podcast, we've also had you on previously, so if people are interested, be sure to check that out. Obviously, we have the book Auditing with Agility, so that's a really good resource. But what about other resources that you feel like people should look into or that you could share?
A
Yeah, so I'm really excited because I know I've been pushing for a lot of these things for the past few years. So what's really exciting is when you get momentum outside of your own personal experiences. So there's an organization called the Agile Business Consortium that they're focused on business agility. So while I talk about agility and internal audit, you know, a lot of the things that I talk about are applicable regardless of whether you're an audit or in just in life in general. Or a different part of business. So I, I like the work that they, they published recently. It was their annual Insights report. And so the themes that were published in that report and we can put a link to that, I can get you a link to include in the show. Notes. One of the things that they, the themes that arose from that report was a shift to mindsets. So a shift from practices first to a combination of mindsets supported by practices. And they also covered things like measuring progress in terms of outcomes versus just output. So a lot of the things that I've been, that we just talked about in this episode are things that successful organizations that the Agile Business Consortium has interviewed, that they've achieved. So there's a quote that I want to pull from it and it says we see organizations becoming better at balancing being agile with doing agile in order to provide value. And so I know for those of you who have heard me speak at conferences or read blog posts or probably even on my previous appearances on the audit podcast, I talk about being agile versus doing agile. And that truly is a shift from like doing agile is doing the things, it's the noun to being agile being more of that adjective, the mindset, the behaviors. So really excited about that. That report is coming out showing that successful organizations are finding that balance between the two and adding that mindset in there. So another thing that was highlighted in the report, and I'm going to quote this one again, is that successful organizations are shifting from tracking activities to measuring impact outcomes and value delivered. So again, that gets back to when we talk about a mindset, what does it mean to have a mindset? What does it mean to lead with a mindset? It's anchoring to that. Why, why are we doing this? Why are we, by doing this, why are we even auditing? Why are we analyzing things? It's to deliver value. It's to achieve those outcomes. So again, it's just really refreshing and validating that the things that I've been talking about, the things that I covered in my book from 2023, are now starting to gain a lot of mom momentum, even outside of auditing, in addition to auditing. So just really cool to see beyond just my own experiences, beyond just my own circle of influence that other people are coming to these same realizations and they're starting to gain traction with them. So I'd recommend if it's something you're interested in checking out, that, that resource from the Agile Business Consortium, okay.
B
And this is an annual report. So if we sign it, like I love Signing up for newsletters. I send all my newsletters to one inbox. So context switching. I just scroll through those and go, yep, I'll read this one today. Nope, don't care about that one. So anyway, I'm going to sign up for it. But so this is an annual report that comes out. So every year I could check this out and kind of see the trends of what's going on.
A
Yeah. And they'll even have. So this year they had a webinar that went through the highlights of it. Okay. So it could even be something. And instead of reading the whole 12, 20 page report, instead of having to put it into AI to summarize it for you, they have a 30 minute webinar sometimes that will summarize the highlights for you. So make it even easier.
B
I told you when you came on that one reason I wanted to have you back on. Well, one, we had a request for it. Two, I had a selfish question that I wanted to ask. So working with the team now, they have one data analyst. So we just call this use case, the use case corner or something. It's not too bad off the top of my head. Okay, one analyst amongst 30 auditors, we'll say, and these teams are broken up into like the Sox team, the OPS team, the data team and the IT team. And so they've been agile for a while. And the analyst, because it's the only analyst, is going, hey, I'm on like four stand ups a day sometimes because there might be a data piece or there is this data piece and it's like, even if maybe people stick to the 15 kind of minute, I'll call it best practice, for lack of better words, which ends up going into 30 minutes and sometimes longer. That's still an hour of sitting on those. So what advice do you have in situations like that? Because I know others, it's. I always thought it was pretty funny if you go to Reddit, just all the, the comments around agility and how much people are just like, like this part of it sucks or like I'm on these standouts all day, how can I ever get any work actually done? So again, any advice that you would have in on that use case?
A
Yeah, absolutely. And as you know, I'm, I'm an auditor at my core. I also really enjoy coaching people too. So because of that I'm going to ask questions. So I would, I would have them, I would ask them questions about like, why are they attending the standups? You know, what are the objectives of those standups? You Mentioned like they're supposed to be best practice, 15 minutes, but they end up not being, you know, 15 minutes. That's likely because they're not. They've turned from a stand up to just a daily meeting. So questioning those and challenging those, finding out what value do those meetings bring to the individual and what value does that individual bring to them? You know, are they, are they truly standups or are they just meetings? There is a difference if we think about what. And, and from there I would, I would be able to give some advice. But so if we, if we think about the purpose of a standup, it's usually so that the auditor in charge or the lead auditor, whatever, whatever the role is, knows what the status of everything. Not just these are in progress. But yesterday I accomplished this. Today I'm going to focus on that so they can help them prioritize. Like, oh, okay, well, you're going to focus on that. But really what we need to get done is this. So I'd ask you to switch and reprioritize that. So like, like that is a super high level, the objective of a standup. So we're going to get back to this theme of anchoring back to the why. So why are they attending these? If there's, if, if the why isn't clear to them, then they need to get that clear. And if there's not a clear value proposition, I'd question, do they even need to attend them? And I know you're like, oh, Clarissa, you're the, you're the agility, the self proclaimed agility queen. Like why are you saying don't attend these meetings? Something that personally I've been trying to do more is challenge. What value am I adding in a meeting? What value am I getting from a meeting? And do I actually need to be there or does it need to happen right now? Because calendar management has been development item for me for years and having that mindset has really helped. So if there's not a value for them to be in those meetings, either a value for them or a value for the audit team, then maybe don't go likely there's going to be a clear value proposition. So then I'd often think about like what might be a different way for them to achieve that. Like, let's approach this with agility, right? If we, if we get stuck in the things, we're having the standups to have the standups, right? But if we think about the why we're having the stand ups so that those lead auditors or auditors in charge, have an idea of what the data analyst is working on, what they've accomplished and to help resolve any conflicts. So maybe in that instance, and this is, you know, applicable to the data analyst or any other shared service within internal audit where you're going to be on a lot of different audits, maybe that makes sense to have the, that data analyst meet with their just one 15 minute, stand up with their auditors in charge and talk to them about, here's what's on my plate, here's what I've accomplished, here's what I want to prioritize for the day. And that also helps them think about, all right, I've got these things that I'm supposed to prioritize today. One of them's got to give. We're all in a room. Let's figure out what, what I should focus on. So I know that's kind of. There's not specific advice as to like only attend one or do this, but always look for that option C. So figure out what your what, your why is, what the value proposition is, and then try to find that win. Win. There's usually, you know, we're, we're presented with options A and B. My team laughs at me because I always look for what's option C, D.
B
And maybe even E. Another fantastic one. Thank you so much for coming back on. I know you have a ton going on and like I said, there was specific requests for can Clarissa come back on? Like, we're going agile. And I even said, yep, that's cool. Send me whatever questions you have and we'll just. So thank you to the audience also, because most of these came from them and I just passed them along. So thank you to the audience for that. And then, Clarissa, thank you for absolutely crushing it. With that said, I'm going to give the, the mic to you. You can close this out.
A
Awesome. I just want to remind everyone, focus on your why. You know, if you take nothing from this, focus on your why. Practices will follow. And then kind of the other thing that I'd recommend is look for that, look for that third option. So it's part of decision making, how to make better decisions. Expand your frame of decision options when you're making decisions that'll also help you work in a more agile way. So appreciate, Trent, you having me on here. Thank you to all the listeners for listening to this and any of the other episodes that I've been on and requesting me. And if you need anything, reach out to me on LinkedIn.
B
Hey, everyone, thank you very much for listening to this episode of the Audit Podcast. Whatever platform you're listening on right now, I'm sure there's a subscribe button somewhere, so please hit the subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five star review and it really helps to get future guests to come on the show, so we'd really appreciate that. Lastly, be sure to check out the show notes and follow us on all our social media channels, on Instagram, on LinkedIn, and on TikTok. Also, if interested, please sign up for our weekly newsletter from the Audit Podcast. Thank you all. Have a great one.
Host: Trent Russell
Guest: Clarissa Lucas, Author of "Beyond Agile Auditing"
Release Date: November 4, 2025
This episode explores the evolving role of agility in internal audit, focusing on the crucial distinction between adopting agile methodologies (the "things" or "practices") and fostering an agile mindset. Clarissa Lucas, an established expert on audit agility, returns to discuss practical feedback loop techniques, the importance of anchoring to a team or organization's "why," and real-world guidance on effective agile adoption. The conversation draws on Clarissa's personal experience, research insights, and audience-submitted use cases, particularly relevant for audit teams seeking to enhance value delivery while keeping pace with change.
Definition and Shift in Thinking
“Agile just means the ability to respond, to change, the ability to move quickly or to be adaptable. Agile is actually an adjective... it describes how we audit.” [11:52]
Methodologies are Tools, Not the Goal
Driving Change through Purpose
“If you had one practice to start with, it would be feedback loops, early and often.” [16:34]
Integrating the ‘Why’ into Everyday Practice
What is a Feedback Loop?
“What a feedback loop is, is essentially a way of gathering information or feedback, considering that information and then adapting as you see fit.” [27:47]
Practical Example
“It’s not a feedback loop... this big thing that you have to do. It's very simple and it's very rewarding.” [30:50]
Granular Task Structuring
“If you can break down that control or task... into more granular subtasks, then you’ll start to see more progress and... where you, as a leader, need to jump in and help.” [22:54]
Limiting Work in Progress (WIP)
“Make sure you’re measuring that... whatever those KPIs are that you choose, it is aligned with that why.” [26:23]
Agile Business Consortium Annual Insights Report
“We see organizations becoming better at balancing being agile with doing agile in order to provide value.” [33:06]
Other Resources
AI and Prompt Engineering for Audit Tasks
Managing Stand-Ups & Meeting Overload
For teams with only one data analyst frequently pulled into multiple stand-ups: Challenge the necessity and value of each meeting; look for alternative coordination methods; continuously re-anchor to the why for participation.
Clarissa Lucas:
“If there’s not a value for them to be in those meetings, either a value for them or a value for the audit team, then maybe don’t go...” [39:05]
“Always look for that option C. So figure out what your why is, what the value proposition is, and then try to find that win-win.” [41:00]
For further learning, consult Clarissa Lucas’s book “Beyond Agile Auditing” and the Agile Business Consortium’s annual insights and webinars (links in show notes).