6.1 Agile, Traditional, Integrated, and Remote Approaches

6.1 Agile, Traditional, Integrated, and Remote Approaches

Quick Answer: CIA Part 2 A4 asks you to evaluate agile, traditional, integrated, and remote approaches and pick the one that can produce sufficient, reliable evidence for this engagement's objectives. These are internal audit engagement designs, not software-development religions. Agile does not waive a work program or evaluation criteria. Remote auditing of a client remains valid; the CIA exam itself is Pearson VUE test-center only (OnVUE remote testing ended 27 May 2025).

CIA Part 2 Section A is Engagement Planning (50%). Official objective A4 is: evaluate various approaches such as agile, traditional, integrated, and remote auditing to determine the most suitable approach. That is a Global Internal Audit Standards (GIAS) Domain V skill — Principle 13, Plan Engagements Effectively — especially Standard 13.6 Work Program and the evidence duties in Principle 14, Conduct Engagement Work. It is not a Part 3 item about how the chief audit executive (CAE) builds the annual plan, and it is not a question about where you sit the CIA.

The exam trap is treating “approach” as a branding choice. Approach is a planning control. It decides how you sequence work, who sits in the room, how you obtain evidence, and how much you disrupt the activity under review. If the approach cannot support the objectives and criteria you already set (Chapters 2–3), it is the wrong approach — even if it is fashionable.

Why approach selection is a planning decision

You do not pick agile because the shop bought a Kanban board, or remote because travel is expensive, and then reverse-engineer objectives. The testable sequence is:

1. Objectives, scope, and criteria — what must be true, and how you will know.
2. Risks of the activity and of the engagement itself — who, where, what evidence.
3. Approach that can gather that evidence with acceptable disruption and specialist mix.
4. Work program, hours, and a supervision path that match the approach.

Every approach still requires documented objectives, evaluation criteria, a work program that can achieve the objectives, evidence that is relevant, sufficient, and reliable, and supervision that starts in planning. The approach changes how you satisfy GIAS. It does not change whether you satisfy GIAS.

Traditional (sequential) engagements

Traditional internal audit engagements are sequential: planning → fieldwork → reporting. Scope is relatively stable. The work program is written up front in more detail: populations, samples, tests, and evidence requests are designed before you spend significant time in the activity.

Use traditional when the process is mature and criteria are known (policy, statute, signed service-level agreement), when you need a complete, comparable sample before you conclude (for example, a full-period three-way-match test), when stakeholders expect a single, well-scoped visit rather than a series of sprints, or when this is first-time coverage and you must map the process before testing. Traditional is not “old-fashioned.” It is the right tool when stability of scope and completeness of a planned sample matter more than early, partial insight.

The cost of the design is real. Issues found late in fieldwork can force rework, and a frozen program is slow when the activity is changing underneath you.

Agile engagements

Agile internal auditing uses iterative sprints, a backlog of audit questions, and frequent stakeholder checkpoints. A sprint might be one or two weeks: pull a slice of the backlog, perform tests, share interim results with the process owner and the supervisor, and refine the next slice. The backlog is a prioritized list of audit questions and tests mapped to engagement objectives — not a software product-development story list, and not a parking lot of stakeholder complaints.

What agile is not: an excuse to skip a work program, criteria, or documentation; a plan to “figure out objectives after we see what we find”; daily stand-ups instead of supervision; or permission to issue findings against unagreed criteria because a sprint ended.

GIAS still applies. Standard 13.6 requires a work program that achieves the engagement objectives. In an agile engagement the program is living: you update tests as sprints reveal process reality, and you document those updates. You still lock objectives and criteria at the start (they change only through the Chapter 2 change-control path). You still retain evidence a competent person could re-perform. You still have a supervisor who reviews planning, not only the last sprint demo.

Agile fits when uncertainty is high: a digital product that changes every release, a shared-service migration, a control environment you cannot map from last year’s walk-through. Early checkpoints reduce the risk that you spend six weeks testing a process that no longer exists. Agile does not fit when a regulator or statute requires a complete, pre-defined sample over a closed period and partial sprint results would be misleading as a conclusion.

Integrated engagements

An integrated engagement combines operational, financial, IT, and compliance objectives — and the specialists who can test them — in one engagement of the same activity. The point is not a longer report. The point is to avoid duplicate client burden (three opening meetings, three request lists, three weeks of the same accounts-payable manager walking through the same invoice) and to catch interface risks that single-domain audits miss.

Interface examples the exam likes:

• IT access provisioning versus financial close: a terminated user still posts journals.
• Third-party service-level agreement versus operational performance versus privacy: the vendor meets uptime and leaks data.
• Procurement compliance versus inventory existence versus ERP three-way match: a clean match on a receipt that never hit the dock.

Integration is a team and objective design, not a slogan. If the IT specialist runs a separate project with a separate scope and never reads the operational tests, you have four audits wearing one kickoff slide. Plan a single request list, a shared process map, joint walk-throughs, and tests that explicitly address hand-offs. Specialist mix is a decision factor here. Hours and competency gaps you cannot cover are a Chapter 10 resource issue — raise them in planning rather than pretending the “integrated” label supplies a missing skill.

Integrated work is usually the right default for ERP-centric processes (order-to-cash, procure-to-pay, hire-to-retire) where financial, operational, and IT general-control risks share the same system. It is the wrong default when combining topics would dilute a required deep dive — for example, a cybersecurity Topical Requirement engagement that needs dedicated scope, not a few IT questions tacked onto an accounts-payable audit.

Remote and hybrid engagements

Remote auditing obtains evidence without the team sitting in the client’s facility: video walk-throughs, data extracts, screen-shares, secure file transfer, and interviews by video or phone. Hybrid means some procedures on-site and some remote — counts and culture on-site; configuration extracts remote.

Remote is a valid engagement approach for clients in 2026. Do not confuse it with how you sit the CIA. The IIA discontinued OnVUE / online testing on 27 May 2025. Part 2 is delivered at a Pearson VUE test center only. A question about “remote” on this exam is about auditing the activity, not about your appointment.

Remote strengths: multi-site coverage without travel days, faster access to ERP logs and data warehouses, less disruption of a busy operations floor, and the ability to involve a specialist who cannot fly. Remote limitations you must plan around:

• Physical observation — you cannot watch the dock, the cage, or the cash drawer the same way.
• Inventory and existence — screen-share of a spreadsheet is not a floor-to-sheet count.
• Site culture and tone — cameras show the meeting, not the hallway.
• Unannounced procedures — hard to surprise a count you scheduled on a video call.
• Evidence authenticity — confirm extract source, completeness (row counts, control totals), and that the screen-share is the production system, not a demo company.

If existence, physical access, or culture is essential to the objective, remote-only is the wrong approach. Hybrid is often the adult answer: travel for the count; pull the logs from home.

Decision factors

The syllabus wants a reasoned choice, not a favorite methodology. Walk the same six factors every time.

Worked pattern. A three-plant inventory existence review with a weak warehouse culture and an ERP that can dump complete perpetual records. Risk and evidence quality demand on-site counts. Location argues hybrid (travel to plants; extracts for perpetual-to-floor reconciling items). Specialist mix may add an IT auditor for perpetual-record completeness. Disruption argues a short, well-notified count window — not a six-week traditional occupancy, and not a remote-only “count.” Agile sprints could sequence plant 1 then plant 2 if you update the program, but you still need a complete count program, not a backlog of optional visits.

Combining approaches and the documentation bar

Real engagements mix labels: integrated + hybrid + traditional program, or integrated + agile sprints on a transformation. The file must still answer four questions: What is in scope? What criteria will we use? What approach will obtain the evidence? What work program implements that approach? If those four sentences are missing, the methodology brand will not save the engagement — or the exam item.

The testable rule is always: objectives and criteria first, approach second, GIAS documentation in every case. Fashion is not a planning control.