Agile Internal Auditing Training Course: Sprints, Backlogs and Rolling Risk Assessment

Programme Summary

Agile internal auditing is the subject of this one-week training course for internal auditors, audit managers and heads of audit, ending in an agile audit pack for one audit area. Annual plans age quickly, long engagements delay findings and managers see results after the risk has moved. The programme shows how to plan audit work in short cycles from a ranked backlog, deliver it in sprints and report in step with management, while keeping evidence and independence intact. Mars Training Centre UK delivers this programme on agile internal auditing to mixed-organisation cohorts.

The Business Case

Agile internal auditing matters when risks change faster than an annual plan can follow. Where engagements run for months, findings arrive late, scope drifts and stakeholders disengage. Teams that rank work in a live backlog, deliver in short cycles and review their own method give management timely assurance without lowering the standard of evidence.

• Assurance Timeliness: Improves as findings reach management during the engagement rather than after it.
• Plan Relevance: Improves as the backlog is re-ranked when risks change.
• Stakeholder Engagement: Rises as managers take part in short reviews of progress.

Principles and Evidence Base

• IIA Global Internal Audit Standards: Their guidance on risk-based planning, engagement planning and communicating results sets the fixed quality floor applied in Sessions 1 to 4.
• Scrum Guide: Its definitions of sprints, backlogs and reviews supply the cycle structure used in Sessions 2 and 3.
• Agile Manifesto: Its values on collaboration and responding to change frame the stakeholder and retrospective work in Session 4.

Intended Participants

• Internal auditors who deliver engagements and want shorter cycles.
• Audit managers who plan resources and supervise fieldwork.
• Heads of audit who own the plan and report to the committee.
• Quality leads who protect evidence standards in the audit methodology.
• Risk and compliance staff who work alongside audit teams.

Typical sectors include banking, telecommunications, energy and public bodies.

Learning Outcomes

1. Participants will be able to evaluate which engagements suit short cycles and which need a fixed plan.
2. Participants will be able to construct a rolling risk assessment and a ranked audit backlog.
3. Participants will be able to design a sprint with a clear goal, tasks and evidence standard.
4. Participants will be able to prioritise interim findings for stakeholders without weakening the conclusion.
5. Participants will be able to diagnose weaknesses in a sprint through a retrospective.
6. Participants will be able to justify safeguards for independence and evidence quality.

Programme Structure

Day 1: Agile Internal Auditing Foundations

What changes when audit work is planned in short cycles, and what must stay fixed?

• Agile Values Mapped to Audit
• Independence Safeguards Checklist
• Audit Team Roles Chart
• Cycle Length Decision Sheet
• Evidence Quality Floor Statement

Day 2: Rolling Risk Assessment and the Audit Backlog

How is a ranked list of audit work kept current as risks move?

• Rolling Risk Assessment Template
• Audit Backlog Register
• Value and Risk Ranking Matrix
• Stakeholder Input Calendar
• Backlog Review Protocol

Day 3: Sprint Planning and Delivery

How is a slice of audit work scoped, assigned and delivered within one sprint?

• Sprint Goal Statement
• Task Breakdown Board
• Daily Stand-Up Format
• Working Paper Light Standard
• Sprint Review Demonstration

Day 4: Stakeholders, Reporting and Retrospectives

How do short feedback loops reach management without weakening the conclusion?

• Stakeholder Collaboration Map
• Interim Findings Note
• Lean Audit Report Layout
• Retrospective Question Set
• Improvement Action Log

Day 5: Applying the Tools to One Audit Area

Do the backlog, sprint and reporting tools produce one agile audit that holds together?

• Applying the Session 2 Audit Backlog Register
• Using the Session 3 Sprint Goal Statement
• Running the Session 3 Daily Stand-Up Format
• Checking the Session 4 Lean Audit Report Layout
• Completing the Agile Audit Pack

Methodology

The programme uses a structured exercise method built on anonymised audit plans, backlog extracts, working papers and report drafts from banking, telecommunications and public settings. Participants work in audit teams on one shared case, run short planning and review meetings in role, and receive written facilitator feedback on every exercise set across the five sessions.

• Suggested activity: Ranking a twelve-item backlog against a changed risk profile.
• Suggested activity: Running a stand-up and a retrospective for a role-played audit team.
• Suggested activity: Turning a long draft report into an interim findings note.

Capstone Output

Each participant completes an agile audit pack for one audit area. It holds a rolling risk assessment, a ranked backlog, a sprint plan with evidence standard, an interim findings note, a lean report layout and a retrospective action log. The pack is used at work to pilot agile delivery on a live engagement and to brief the audit committee on the change in method.

Frequently Asked Questions

Is agile internal auditing suitable for auditors with no agile experience?

Yes. Agile internal auditing starts from the vocabulary of sprints and backlogs and builds step by step, so it assumes audit experience but no earlier agile practice.

Which standards does agile internal auditing draw on?

Agile internal auditing draws on the IIA Global Internal Audit Standards for planning and reporting, and on the Scrum Guide and the Agile Manifesto for cycle structure and values.

How is the pack from agile internal auditing used at work?

You use the agile audit pack to pilot short-cycle delivery on a live engagement, to rank your backlog and to brief the audit committee on the change in method.

How does agile internal auditing differ from traditional internal audit planning?

Agile internal auditing plans work in short cycles from a re-ranked backlog and reports as it goes, while traditional planning fixes scope for the year and reports at the end.