My company is an ISV and occasionally, prospective customers (especially in life sciences) insist on sending in auditors to check over our software development processes.
We are starting to implement Scrum/Agile and my CEO is very concerned about how such an auditor would react to this. His concern (which I share to some extent) is that an auditor would expect to see a signed-off specification document against which the software is developed and then tested, and they wouldn't be happy with an incremental approach which doesn't really deliver a full specification at all.
Does anyone have any experience in this respect? Is it usually necessary to fudge the issue slightly by "signing off" a user story, or producing a retrospective specification document etc.? My only defense to the CEO so far is that agile is almost universal in software development, so they are bound to accept it as valid, but I don't know whether this is true.
I have seen some discussion about ISO 9000 and the general consensus seems to be that agile is not incompatible with that, but I don't think that's really the same question because my sole motivation is to be sure we can satisfy an auditor. FWIW We are not ISO 9000 certified and have no intention of doing so, and auditors have not had a problem with this in the past.