GUEST BLOG
Remote internal auditing is largely a product of the pandemic, an invention mothered by necessity as audit teams were forced to work remotely and travel was restricted. It is becoming clear now, though, that they are here to stay.
I must admit that not all of us were sufficiently prepared to take on remote auditing and likely underestimated the challenges of switching from on-site to remote audits. Experience, however, has shown us otherwise. There are many lessons to be learned from last year’s experiences and still many to come, as remote auditing becomes a mainstay in the internal audit toolbox.
Here we will examine some of those lessons and consider strategies for making remote audits run smoothly and produce the same results that would be expected from on-site audits.
Planning
For remote audits, the planning phase becomes even more critical than ever before. Here are some key elements:
Key people: Key personnel need to be identified up front. For on-site reviews, during the scoping portion of planning, you get a listing of key stakeholders, and during the fieldwork you can identify additional relevant individuals working in each portion of the process. This is a natural process since you have constant communication with the on-site team. During remote audits, however, the opportunities to identify and bring on board additional key personnel in a timely manner is limited due to availability restrictions. For each portion of the process, a listing of participants should be documented as part of the audit workpapers and shared with the auditee for validation.
Walkthroughs: Walkthroughs should be performed during the planning phase. During on-site audits one has the option to perform process walkthroughs either during the planning phase or during fieldwork. For remote audits, however, in order to have a more effective usage of resources, it is recommended that detailed process reviews are conducted during the planning portion of the review. The outcome of this part of the assessment should be documented as part of the audit workpapers and shared with the auditee for validation.
Initial Data Request (IDR) should be confirmed with process stakeholders prior to submission. For standard reviews, audit teams have pre-defined IDR’s (also known as PBC or Provided By Client lists). However, given the potential changes in the audited process derived from the pandemic, it is possible that the required elements may have changed. For non-standard reviews, the IDR will be directly connected with the walkthrough process. In any case, the IDR should be agreed with each of the process stakeholders prior to submission. It is recommended that a single individual from the auditee team takes ownership of the request fulfillment, and that progress is monitored on a regular basis with the audit team, establishing a common repository for the provided information, available to all audit team members.
Project timeline: The project timeline should be realistic. With all the elements above and considering the available resources, the auditor in charge should define a realistic schedule. Different from on-site audits, remote audits include the complexity of having the audit team involved in multiple projects simultaneously. Those activities should also be considered to plan the assessment. This timeline should be reviewed with the audit director and with the auditee team representatives and should clearly state all considerations towards the project, such as resources, availability, required response timeliness, and others. Status meetings should be scheduled, at least weekly, to inform about the project progress, and all heads and stakeholders should be invited to attend.
Tools: All tools should be agreed ahead of the audit start date. Most organizations have standard tools for video conferencing, file sharing, data analysis, issues follow-up, etc. The audit team should understand the main features available for each one to ensure security, accuracy, and effectiveness of communications throughout the project. For instance, features used to record video calls (if allowed by the company policy), security for data sharing (especially for sensitive matters), and tools for data extraction (access to data could be open for auditors or restricted only to process owners).
Fieldwork
For remote audits it is critical to identify ways to keep the team motivated and focused, especially in environments where there are multiple projects running simultaneously.
Team engagement: The audit lead should identify mechanisms to keep the team on track. It is recommended to have internal status meetings at least once a week. The auditor in charge should encourage the team to keep an online version of the audit program updated on daily basis, as well as an issues log for any potential findings resulting from the fieldwork. Potential issues should be available to the audit director as well for discussion.
Communication: Communication in the project should be as open as possible. Although communication standards should be set for the engagement, the team lead should keep open interactions with both, the audit, and the auditee teams. This can have a positive influence on the auditee personnel’s willingness to have open, unscheduled conversations. The purpose of this is to create a proximity to the on-site experience where the auditors interact more frequently with the auditee to build rapport.
Status meetings: Status meetings should include all key personnel associated with the review. It is the responsibility of the lead auditor to schedule status calls in advance. In addition, the lead should schedule calls with management-level stakeholders to ensure all levels of the organization are on the same page regarding the audit status and findings. Any issues preventing the on-time completion of the assessment should be discussed and escalated as required to prevent significant project delays. To have effective meetings, rules of engagement should be established in advance. For instance, duration of the calls, discussions to be taken off-line, mandatory minutes, evidence delivery deadlines, and more.
Issues: All issues should be clearly communicated and agreed (internally and with the auditee) prior to formally being communicated to an audience other than the process owner. This is especially important when multiple individuals participate in a process or control. The challenge in remote audits is to have all the audience involved and in agreement on the issue wording and in the corresponding management resolution actions.
Reporting
Having a clear and engaging audit report is crucial for the success of the audit.
Closing meeting: The closing meeting should be managed as a summary of the issues previously discussed and agreed during the status meetings. The call should consider the different time zones of the attendees to ensure all required participants are included. During the meeting, a first draft of the audit report can be presented, indicating the issue, the owner, and the agreed-on remediation plan.
Final report: Although the final audit report should be formally communicated, according to the Internal Audit department guidelines, it should also be made available online to all related parties. This will allow more efficient follow-up procedures by permitting the electronic collection of evidence to close issues.
While remote audits are here to stay, organizations still have work to do to perfect them. As the technology and practices improve, remote audits will only become more efficient and effective, rivaling their on-site audit cousins. 
Hector Garcia is an active community member of Auditopia, a new learning and collaboration platform for internal auditors. He’s recently co-lead one of its bi-weekly virtual events on successful remote internal audits; the recording is available here.
I fail to understand any notable difference or changes in remote audit after going through this article. It is same what we do in normal onsite audits.
A little more than a year before the pandemic hit we modified our audit process whereby most of our audit procedures were conducted from the office with a limited amount of field work for those areas where original documentation and observation were necessary. We only conducted on-site audits where there were new business managers at the locations.
Prior to that time all of our audits were conducted in the field. When the pandemic hit we modified the procedures conducted in the field so we could complete them from the office. The economic benefit and time savings from not traveling have been positive with little associated risk related to the procedures previously conducted in the field. The downside is the guidance provided to the new business managers-that cannot be done effectively unless onsite.