Be the change you want to see: Agile Internal Audit Leadership

As a part of the transposition of the EU Anti-Tax Avoidance Directive into its national legislation, Luxembourg has also introduced controlled foreign company rules. These rules are completely new to the Luxembourg tax system and apply to Luxembourg taxpayers for financial years starting on or after 1 January 2019.



Sandy Pundmann - Partner - Internal Audit - Risk and Financial Advisory - Deloitte

Sarah Adams - Managing Director - Internal Audit - Risk and Financial Advisory - Deloitte

Ranjani Narayanan - Senior Manager - Internal Audit - Risk and Financial Advisory - Deloitte

Denise Wolf-Hill - Specialist Master – Enterprise Agility – Enterprise Technology Operations – Deloitte Consulting

Published on 29 April 2019

Share this article


Did you check your email or calendar on your phone this morning to see your agenda for the day? Now, think back to 15 years ago and what your phone could do for you. Today, it seems like there is an update or a new relevant application promoted every week, if not every day.

Although Internal audit (IA) performs assurance and consultative activities to provide the third line of defense for management around risk, the core process of performing audits has not changed in decades. The world of business as we know it is radically shifting around us. IA was designed for an age in which enduring stability defined competitive advantage, and slow and steady methodical testing took flexibility out of the equation. In order to support an adaptable organization in the modern world, IA’s structure and ecosystem need to change and adapt as well. That is why we have applied agile values and principles to IA to create Agile IA. The mindset and cultural shifts required by Agile IA begin and are led by IA leadership.

Leaders must drive the change they wish to see in their organizations through three leadership capabilities: the ability to energize, to empower, and to connect.

ENERGIZE: leaders must become storytellers.

Leaders hold the vision of what is possible for the organization, share the vision consistently, and co-create the mission with their teams. Progress is never one-and-done, and sharing vision and mission needs to be done consistently and frequently. Doing so allows others in the organization, who are willing and able, to align themselves with this bold new vision. People are energized by leaders who have a broader concept of what is possible and provide psychological safety for people to join in. IA leaders must be visionaries striving to fulfill the role of a true leader, rather than acting by title alone.

EMPOWER: leaders must act as servant leaders,

removing the roadblocks that prevent talented teams from achieving their outcomes. They must be aligned with agile principles and values and be role models for their organization. When leaders get out of the way, they enable people to achieve the right outcomes on their own. People connect with and trust leaders who authentically present themselves as having their best interests at heart and allow them to grow, learn, and to be creative in their work. Trust fosters collaboration among team members.

CONNECT: leaders should take a systems view.

Many IA leaders have already taken steps in this direction as they move their brand away from “policing” towards being a trusted advisor. IA leaders need to consider the whole organization versus a narrow view, purely from an assurance perspective. Embracing the collaboration with key stakeholders that Agile IA requires—from defining the scope and agreeing on prioritization, to communicating IA’s point of view at the end of each sprint—is a further step in this direction. When leaders reach across their organizations, they build alliances and, in return, obtain buy-ins from diverse stakeholders. Leveraging other perspectives and applying shared learning creates a collaborative and competitive edge.


Change cannot be something that happens to someone else.

You need to be willing to make changes in how you operate as a leader for the Agile IA transformation to be successful. You must believe in the values and principles of agile, be willing to get out of your comfort zone, and trust that this can work. This is often hardest for those who have worked in the old ways longest: mid- and executive-leadership levels. Your teams need agile IA coaches. As do you.

Small shifts by leaders can result in an enhanced culture with the least amount of organizational chaos.

Culture is not a poster on the wall, it is what leadership allows. If a company proclaims it is transparent, but allows information to be hidden and withheld, it does not have a culture of transparency but one of secrecy and withholding. Small, “minimum viable changes” work well for this—leaders should experiment and then inspect and adapt what they learn from the experiment. IA professionals look to their leaders to model this type of agile leadership, to “walk the talk” and to take risks.

This isn’t about following the crowd.

You need to figure out the unique needs of your organization. While a framework such as Scrum can help you get started with some guardrails, you cannot let your organization stop there. Help your teams get good at working within a framework, if you are continuously improving, some limitations caused by the framework itself may arise. Leaders must create the type of environment where teams are rewarded for smart experimentation and fast learning. At one organization we worked with, one of the IA leaders sent an email to his team thanking them for trying something new, even though it was not successful. Adopt the mantra “no failures, only learnings.”

This isn’t simply a theory.

It’s hard work. Successful companies have found that it takes at least three to five years to change the culture of an organization. Internal Audit cannot expect to transform their culture overnight. As leaders, give your teams permission to call you out when they see you slipping back into command-and-control mode. If you are not at least a little uncomfortable, you are not empowering your teams and are not adopting agile leadership.

You have not done this before.

People like to say “we are already collaborative” or “we already do this.” People have experimented over the years with some similar approaches, but this is about putting teams before individuals, valuing collaboration, developing new structures and ways of working, and creating and supporting autonomous teams that work with purpose. A more senior IA leader at one of our clients believed Agile IA didn’t afford him the opportunity to provide feedback and guidance to his team. Upon digging deeper, it turned out he needed to change the cadence with which he engaged with his team. He needed to adapt to their pace, not them to his.

This is about leadership everywhere.

Leaders must enable teams to self-manage their work and become leaders in their own right. You have to tell people the “what” and let them determine the “how.” You have to coach your people to help them develop their ability to take a global view; to embrace a growth mindset; to use logic, imagination, and intuition to explore possibilities; and to seek out and leverage diversity of ideas and approaches to problem-solving.


Many IA organizations begin approaching an agile mindset by experimenting with agile teams. And there have been exciting successes! But these teams cannot sustain their success nor truly transform unless IA leaders also change to:

  • Become energizing story tellers
  • Become empowering servant leaders
  • Connect by taking a systems view

Only in this way can Agile IA leaders build environments where high-performing agile audit teams can continuously improve and thrive.

Share #DeloitteInsideNow


Becoming agile: Elevate internal audit performance and value

With increasing demands and diminishing resources, how can internal audit teams keep up? Deloitte’s Agile Internal Audit methodology could be the answer. The articles below offer a closer look at the basics of an agile approach, how internal audit functions can adopt this methodology, and strategies for internal audit to advise on the risks of business agility.

© 2021. See Terms of Use for more information. Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see to learn more about our global network of member firms. The Luxembourg member firm of Deloitte Touche Tohmatsu Limited Privacy Statement notice may be found at