Remote Internal Auditing: The New Normal - Part 2 Remote Internal Auditing: The New Normal - Part 2

In the previous blog post we discussed reassessing priorities within your internal audit planning and investing sufficient time in preparing for the audit. This post will focus on reporting protocols and the optimization of the usage of tools during the execution of an audit.

Even though from a pure methodology perspective (i.e. IIA performance standards) the execution phase of a remote audit is similar to that of a traditional one, there are still a few differences. 

Traditional audits included physical presence of the auditors that allowed to elaborate and coordinate ad-hoc on site with auditees efficiently, provided opportunities to "read" auditees better and also provide platforms for informal discussions that sometime provide valuable insights into the organization, processes or state of the internal control system. With remote auditing the physical presence is replaced with an increased usage of digital applications, web-based data transfers and audio/video dialogues and thus allows for less of an informal, unofficial or confidential exchange.

To target these differences, the following adjustments could be made to facilitate the remote audit execution process:

Video conferencing tools:
When selecting a communication tool, such as Skype for Business, Zoom, Teams or Cisco WebEx it is recommended to take following guidelines into consideration when planning and executing video meetings:

• Avoid long and intensive video conferences, as they can be more tiring than on-site ones. Rather, split them into several sessions around different topics.
• Try to keep the number of simultaneous participants to a minimum and mute those that are not speaking.
• Try to anticipate the effects of technical issues (e.g. connectivity, sound quality, etc.) by testing beforehand.
• Make sure you are familiar with the functionalities of the tool and can guide people who are having difficulties with, for example, their camera or sharing their screens or documents, etc.
• Not everyone is comfortable talking through video, so try to create a relaxed atmosphere and set the right tone.
• Investigate the possibility of recording video sessions, to facilitate your notes taking. If the interview will be recorded, make sure to get the consent of the participants beforehand and consider data security and privacy issues.
• Last but not least, interaction and attention to personal circumstances is of great importance. Especially in these times, being understanding and empathetic can go a long way.

Document sharing platform:
When it comes to sharing documents, there are multiple ways to do so such as digitally uploading them on a shared platform or receiving temporary access to the databases of the audited firm. However, it is crucial that sufficient attention is paid to the following points:

• Accessibility and security of the platform as well as confidentiality of the information provided needs to be secure; access should be sufficiently restricted and secured by encrypting the data that is sent across the network (in transit); make sure that information is removed in a timely manner from the platform and stored according to applicable archiving standards and data protection requirements (it is important to consider any restrictions that might be in place on data accessibility and transfer between countries, as these could add unforeseen complications and delays).
• Paper records can still be used for efficiency reasons. While a remote audit requires digital documentation, it might be beneficial to maintain some paper records where needed, as digitalizing these can become time consuming. 

Overall, the burden for auditees should be minimized by remaining flexible and providing alternative solutions for information sharing. 

Other sources of information:
Depending on the level of scalability and the complexity of the organization, not all types of audits are efficiently and effectively replaceable through remote auditing. 

Statistics showed that remote auditing was associated with higher efficiency when mostly used in operative- (74%), finance- (65%) and IT-audits (60%). In contrast, fraud audits and consulting services were perceived less efficient when executed remotely. However, with many travel restrictions still in place, the types of audits which would be better equipped by physical presence are not a choice, as they still need to be conducted remotely. In this case, a solution could be the use of local resources (i.e. internal audit co-sourcing partner).

Alignment with the auditee:
While working remotely, it is even more important to keep close contact with the auditee to remain aligned. Scheduling recurring short meetings (e.g. daily or weekly) to discuss the status of the audit but also to capture any worries or concerns is most beneficial and ensures that the timeline of the audit (i.e. two weeks) is met and not prologued due to unattended calls or the missing retrieval of supporting documentation.

 

In order to improve efficiency for remote audits, reporting protocols need to be revised in how frequently things are communicated and when the interaction with the auditee is sufficient. Therefore, internal audits should pay attention to following points:

Validation of findings:
Each observation needs to be discussed and validated with the auditees before finalizing the report; Any feedback received should be incorporated in the report and previously identified risks and opportunities should be updated and tracked accordingly.

Documentation of new processes:
It is essential to record which tools were used during the remote audit and how effective they were in achieving the audit objectives. Furthermore, a debrief of the remote audit procedures is important to determine its effectiveness and identify opportunities for improvement.

While the above-mentioned measures are already implemented on a temporary basis for many organizations, it is very likely that (some of) these new ways of working – like remote auditing – are here to stay.

It is therefore important to set-up a remote audit process as thoroughly as possible with long term success in mind. There are already many positive aspects to consider when adapting to remote auditing for the future, as it has cut high travelling and face-to-face related costs, for example. Above all, in order to accomplish long-term success in remote auditing, the measures implemented need to reflect the key challenges of the future. As touched upon in this article, these challenges mostly revolve around technology, adequate compensation of face to face advantages, the rethinking of audit objectives and procedures, as well as keeping the post COVID-19 situation in mind when forming a sustainable strategy for the future. If adapting and investing right into remote internal auditing, it could revolutionize the efficiency and effectiveness of auditing.