Is Your Agile Audit and Compliance Process Really Agile?

In a previous column, George Schlitz proposed that process improvements, such as agile, require organizations to change process rules. Now George continues his review of agile in regards to compliance and auditing practices. What he's found is that changes to compliance and auditing rules may appear compatible, but the implementation process usually remains unchanged and conflicts with agile practices.

In my article, Agile Removes LimitationsYou Must Now Change the Rules, I proposed that

  1. Process improvements, such as agile, remove limitations that existed in the past, like the inability to deal with change and uncertainty
  2. Based on Goldratt's teaching, in order to get holistic effects from such improvements, we must:
  • Determine which limitations no longer exist
  • Examine the rules we put in place to deal with these old limitations
  • Remove or change these rules to deal only with new or remaining limitations

I believe that many organizations attempting to introduce process improvements of any kind fail to execute the second point. The process improvement is introduced but existing structures still assume old limitations. The result is either less dramatic improvement than we'd like or reversion to the old ways of doing things. This kind of "force fitting" agile into existing organizational processes will certainly hamper your results.

Let's now apply this approach to two common challenges in software product development: compliance and audit processes. Many organizations, especially large companies and those operating in heavily regulated industries, have compliance processes in place that must be met in order to approve software for release. These processes often require activities that appear to conflict with all we have learned about agile, for example, requiring waterfall-like sequential flow of heavy documentation artifacts through the life of a feature request.

Understand Compliance
Generally speaking, compliance is about managing risk. In businesses that face more risk than otherse.g., those developing medical device software upon which peoples' lives depend or software that carries millions of dollars of financial transactions form one place to anothera process, similar to the one below, is used to help manage risk.

  1. Identify and assess risks
  2. Establish controls that attempt to mitigate these risks
  3. Monitor and assess the implementation and effectiveness of the controls
  4. Communicate results
  5. Remediate gaps or observations
  6. Repeat

Audits generally are the implementation of steps three and four. Auditors share an opinion on the controls we establish and whether we are actually implementing them effectively. They generally do not specify what the controls are or which activities need be taken to implement them. The business establishes controls, and auditors basically test whether controls are being implemented.

Is There Already a Problem?
When I started to learn about compliance processes, I immediately recognized a common pattern. Despite the compliance steps above being cyclic, most of the compliance processes I have seen in action seem only to repeat steps three through five. That is, once risk was identified and controls were established, they were pretty much set in stone and rarely changed. At this point, I began to realize that there was nothing in principle conflicting between agile and compliance processes. In implementation, however, compliance and audit can appear as an obstacle to agility, sometimes even requiring that people create artifacts for no other reason than to complete a compliance controls checklist. Though this might satisfy the needs of the audit, it does not do the business a servicemoney is being spent on an effort that probably isn't actually reducing risk.

About the author

AgileConnection is a TechWell community.

Through conferences, training, consulting, and online resources, TechWell helps you develop and deliver great software every day.