Agile Governance and Audit: Oversight That Keeps Pace

Agile teams work in cycles of a few weeks. Many oversight processes were designed around phases that last months. When the two meet, something has to give, and too often it is the agile cadence: teams wait for a review board, prepare documents nobody reads until the end, or report status in a format that makes steady progress look like failure.

Governance does not go away in an agile organization. The U.S. Government Accountability Office (GAO), whose Agile Assessment Guide (GAO-24-105506) was written primarily for federal auditors, is direct about this. It lists "Agile does not require any oversight" as a myth. What changes is how oversight is designed.

This guide is for executives, portfolio and PMO leaders, compliance owners and anyone who will face an audit of an agile program. It covers where traditional oversight collides with agile delivery, and what official sources recommend instead.

Where traditional oversight collides with agile

GAO's guide summarizes challenges federal agencies reported when applying agile methods, drawn from a 2012 GAO report (GAO-12-681). Several are governance problems rather than team problems:

• Compliance reviews were difficult to execute within an iteration time frame.
• Federal reporting practices did not align with agile methods.
• Traditional artifact reviews did not align with agile methods.
• Traditional status tracking did not align with agile methods.

The details are familiar to anyone who has tried this. One official told GAO that compliance reviewers prioritized requests as they arose and that reviews took months, delaying iterations that needed assessment within a few weeks. Oversight bodies requested status reports at waterfall-style milestones, and agile teams became frustrated when dashboard statistics appeared negative. GAO also notes that adopting earned value management gets harder if upper management treats monthly changes in cost, schedule and scope as control problems rather than as revisions to be expected in an iterative process.

Guardrails plus a fast lane for decisions

GAO's answer to the oversight myth is specific. Organizations moving to agile may need to modify their governance practices, including "clearly defined parameters (also called guard rails) within which the team is free to make decisions," together with a clearly defined, fast-moving governance process for decisions outside the team's control.

That sentence contains a workable design. First, write down the decisions a team can make on its own: for example, the order of backlog items, technical approaches within approved architecture, and spending within an approved iteration budget. Second, write down what is outside those guardrails, such as changes to the program's overall scope, cost or schedule targets, or risk acceptance above a threshold. Third, commit to how quickly out-of-bounds decisions will be made, and measure it.

GAO's best practice on life cycle activities supports the same idea. Programs using agile should be allowed to tailor life cycle activities, including technical reviews and their associated artifacts, to their cadence of delivery. GAO warns that if programs cannot do this, the organization's oversight process could disrupt the team's cadence and make development less predictable.

GAO also links unclear goals to heavy governance. When organizational goals are unclear, it says, misalignment can erode trust and often results in overbearing governance and bureaucracy, leading to delays. Clear goals are part of a lighter control system.

Oversee with the evidence agile already produces

Agile programs generate a steady stream of evidence, and oversight works best when it uses that evidence instead of asking for parallel reports. GAO's guide notes that existing agile artifacts, such as lead and cycle time, the number of defects discovered and velocity trends, can be used to oversee an agile program in a real-time fashion. The Agile Manifesto's principles state that "Working software is the primary measure of progress," which makes demonstrations of working software a natural review point.

Baselines and disciplined measurement still have a place. GAO rejects the myth that a schedule baseline cannot be developed for agile work: a baseline should be created alongside rolling wave planning, with enough detail for an agreement between product owners and developers. It also rejects the myth that earned value management is incompatible with agile, and describes a tailored approach. And it rejects the idea that agile needs no documentation, describing instead an appropriate level of documentation at the end of defined time boxes, sometimes embedded in program tools.

One caution for dashboards: GAO notes that velocity is team-specific and should not be compared across teams. A portfolio view that ranks teams by velocity will mislead.

Change approval without a bottleneck

Change approval is where governance and delivery speed meet most directly. DORA's capability page on streamlining change approval reports that its research, presented in the 2019 State of DevOps Report, found approvals are best implemented through peer review during development, supplemented by automation that detects, prevents and corrects bad changes early. It reports that heavyweight approval by external bodies such as a change advisory board had a negative impact on software delivery performance, and that no evidence was found that more formal external review was associated with lower change fail rates.

This matters for compliance because many controls rest on segregation of duties, which DORA describes as requiring that changes be approved by someone other than the author. DORA recommends meeting that goal through peer review, with reviews, comments and approvals captured in the team's development platform.

DORA does not abolish the change board. It describes a strategic role: coordinating between teams, helping improve the process, and weighing in on business decisions that need higher-level trade-offs. Among common pitfalls, it lists treating all changes equally and responding to problems by adding more process, which it says drives up lead times and batch sizes.

Bring security and compliance inside the cadence

GAO's guide includes an example from GAO itself. Its internal IT organization grants authority to operate to systems through a six-step process based on National Institute of Standards and Technology guidance. Teams developed the authorization documentation iteratively and incrementally, held weekly stand-ups with security personnel early in the project, and used environment-wide control practices that deployed applications inherit. According to GAO's IT officials, security personnel are often able to grant authority to operate a few days after an application reaches the maturity needed for production.

The general lesson is to involve control owners from the start and turn repeated manual checks into shared, reusable controls. Compliance becomes a stream of small reviews rather than a large gate at the end.

Preparing for an audit

GAO wrote the guide primarily for auditors, so it doubles as a preparation checklist. Its appendix of auditor's key questions covers every best practice, and it recommends that auditors discuss and agree on common terminology before interviewing a program, because agile terms vary even within one organization. GAO also says that if a best practice is not observable, officials should be able to explain why leaving it out does not introduce unacceptable risk.

For leaders, that suggests three steps. Publish a short glossary of the agile terms your organization uses. Map your practices to GAO's best practices and document any deliberate exceptions with a risk rationale. And keep the evidence, such as backlogs, road maps, review records and metrics, where an auditor can see it without a special data call.

Key takeaways

• GAO lists "Agile does not require any oversight" as a myth; agile changes how governance works, not whether it exists.
• Define guardrails for team decisions and a fast, defined process for decisions outside them.
• Let programs tailor reviews and artifacts to their delivery cadence, and oversee using agile evidence such as working software, cycle time and defect trends.
• DORA's research favors peer review plus automation over heavyweight external change approval, and suggests a strategic role for change boards.
• Prepare for audits by agreeing on terminology, mapping practices to GAO's criteria and documenting exceptions.

Sources

• U.S. Government Accountability Office, GAO Agile Assessment Guide: Best Practices for Adoption and Implementation, GAO-24-105506 (November 28, 2023; reissued with revisions December 15, 2023)
• DORA, Capabilities: Streamlining change approval
• Agile Manifesto authors, Principles behind the Agile Manifesto (2001)