Like many internal functions and most business areas, Nationwide Building Society's 80-strong internal audit team is always under pressure to do more with less or the same amount of resources, according to Eleanor Taylor.
Taylor, a senior manager at Nationwide and a chartered public finance accountant who has 25 years' experience as an internal and external auditor, was approached in 2017 to experiment with using agile business practices in the company's internal audit team. The team is largely co-located with Nationwide's wider business in Swindon in the West of England. The business is a co-operative building society owned by its members and is the world's largest one of this type. With more than 18,000 employees, it is a major player in the UK market, where it commands almost 8% of the current account market and around 13% of the residential mortgage market.
Leaders of the internal audit team believed that implementing agile practices might help the team have a greater impact on the business and achieve more influence in the organisation, Taylor said. There was also a twofold imperative to introduce agile practices in internal audit at the company.
"It's an understanding piece," she said. "In many organisations, the transformation and IT functions are moving towards more agile techniques, which means that we ... need to understand what that is so that we can audit those initiatives ... to provide assurance to the board and to the audit committee that however that work is being developed, it's being developed in a controlled way."
Secondly, it is about working in a way so that "we complement the business as opposed to ... the business becomes more agile, and we stay in this linear sequential approach to our work", Taylor added.
Agile practices were first codified as an efficient, iterative process of software development with the Manifesto for Agile Software Development launched by 17 software "thinkers" at a Utah ski resort in the US in February 2001. Their 12 principles included, as the "highest priority", satisfying "the customer through early and continuous delivery of valuable software".
In a paper last year looking at agile within internal audit, PwC described its basic elements:
- Fast planning and task prioritisation.
- "Sprints" of two to four weeks to achieve specific goals.
- Daily "scrum" meetings of the whole team — to check on progress and solve current problems.
- Regular pauses (sprint reviews) to reflect on what has been achieved and for planning the next sprint.
Taylor explained that implementing agile practices at Nationwide started small by selecting one team that had good relationships with the overall business and was willing to attempt this way of working. "We started small [three audits], listened to the feedback, and then started to improve it and then expand it."
According to Taylor, Nationwide focused the measurement of agile practices' impact on "the things that are of value to us". They are:
- Efficient delivery.
- Audits that are valued by the business, the audit committee, and the UK's financial services regulators (the Financial Conduct Authority and the Prudential Regulation Authority).
- Engaged teams.
After an initial process to identify one metric, those three metrics were instead chosen in order to provide "balance". This was to avoid, Taylor said, a short, efficient audit that turns out to be not valuable, for example, or an audit where teams are working 20 hours a day but are not happy or engaged. "But it's so context-specific ... it may be different for someone else's team," she said.
For Nationwide, a benefit is the added transparency that its audits now have, both for audit team members and their stakeholders. "So that's particularly good for junior members of the team because they get exposed to some really challenging conversations. ... They see our senior auditors in action and how they are able to articulate and influence the wider business."
Increased autonomy is a further benefit, Taylor said. "Using the scrum framework, the team now decides how they're going to achieve that objective. And that provides them with a level of empowerment and engagement that means that they feel more commitment to that work.
"[The team understands its] business environment better than the senior leader who's not in there every day. So they are better able to identify the best way to complete the work to get the outcome."
Teams also become longer-lasting, existing beyond a single audit, and more multidisciplinary with specialists being brought into them, Taylor said.
Taylor's three pieces of advice for a business seeking to introduce agile are:
- Do not underestimate context: What works in one part of the business might not work for another area. One size doesn't fit all.
- Start small and get feedback: It's not a transformation, and using that word will put people off.
- Set the right tone from the top: This creates the psychological safety to experiment and try something new. It's a failure only if you keep doing the wrong thing. If it doesn't work the first time, it's a test. It becomes a failure only if you keep attempting the same thing.
Taylor is enthusiastic about wider adoption of agile practices. "So there are some elements of the scrum framework that won't work, but there are some [that can] — the visualisation of the work, the management of the workflow, the regular communication with stakeholders on the team, and then inspecting and adapting to what you've learned over the last two weeks. I can't think of an area that wouldn't benefit from that.
"But it is all about context and adapting it to your context," she said. "So I could see agile working really well in marketing. It works really well in call centres. You can use it in legal although you'd have to do some heavy influencing right at the beginning for legal. It's definitely useful for accountants ... doing month end. This is really helpful for month end, year end."
"A Business Leader's Guide to Agile", mckinsey.com
"Agile Auditing: Mindset Over Matter", pwc.co.uk
Oliver Rowe is an FM magazine senior editor. To comment on this article or to suggest an idea for another article, contact him at Oliver.Rowe@aicpa-cima.com.