Current audit methodologies are taking advantage of rapid technology advances to offer greater accuracy and insight into complex operations, often with fewer person-hours. Many internal audit departments have applied agile, automated processes to improve the previously manual approach for measuring and managing controls and processes.
But what about the way internal auditors perform the audits, themselves? For example, much of internal audit's work — information-gathering, walkthroughs, and interviews — still is done on-site. Leveraging today's technologies to conduct remote audits could streamline this process and increase the efficiencies of internal audits.
On the Road
Internal auditors perform walkthroughs to measure the effectiveness and level of compliance of an organization's internal control system. The fieldwork portion of these walkthroughs typically involves small teams traveling to various locations and setting up shop for one or two weeks. There, auditors pull team leads, directors, vice presidents, and even top executives away from their daily duties to evaluate the control systems and targeted processes. Teams then perform substantive tests, examine analytical procedures, hold direct interviews, and raise inquiries with various levels of management.
Not only is this approach inconvenient for the individual site locations in terms of blocking out conference rooms, hotel cubicles, and meeting schedules, but it can become time-consuming for leadership and increase internal audit's travel costs. In fact, internal audit efforts can easily reach thousands of dollars per location, team, and area of focus. Moreover, the time spent traveling to the location instead could be spent on auditing, which could decrease the total audit hours.
On-site audits have another downside: The extensive travel and time away from home can actually be a drain on employee resources and contribute to turnover. Like most employees, today's internal auditors juggle complex work and personal lives, including ever-increasing commuting times and expenses, travel, and family responsibilities. Establishing more off-site audit work can help organizations retain talent and in some cases recruit employees who might otherwise not have wanted to work in a location.
Leveraging technology to perform walkthroughs remotely can free up on-site resources and enable internal audit and management to more efficiently plan, interact, and share substantive data. Take for example the planning phase of the audit process. Planning the audit sets the stage for evaluating management's assertions, beginning the process of obtaining material evidence, aligning initial planning expectations with current audit findings, and building the supporting documentation library.
Yet, technology advances have improved routine data-collection activities and streamlined the historically manual methods around the measurement of processes and controls, including compiling information from disparate systems. That has minimized the need to be on-site to gather information.
The key to a remote audit is planning and appropriate resource management. Here are some tips and strategies.
Use technology such as video chats, conference lines, secure file sharing, and virtual private networks. Conversations with the client, or even with members of the audit team, do not have to take place in person. Many organizations have a video chat capability on their employees' computers, enabling auditors to have those face-to-face conversations virtually. In addition, secure file sharing addresses the concerns of clients who do not want to share electronic documents because they fear they will get hacked.
Schedule time ahead of planned fieldwork. This is more efficient for both the remote audit staff and the client. A week or two before the audit start date, auditors should email the client to schedule initial walkthroughs. Auditors should inform the client that they will be conducting an audit remotely and prepare the client to gather any electronic documents needed by the time the meeting occurs.
Establish the remote auditing rules of engagement for the internal audit team. Whether it's one person or an entire team working off-site, the remote auditors should be aware of expectations. For example, rules of engagement could include when individuals should be available, status updates at the end of the day, and points of contact on the audit team for questions before engaging the client. These rules can help achieve good communication, which sometimes can be lost when auditing remotely.
Determine specific roles and responsibilities for all team members. Roles and responsibilities can be included in the rules of engagement. For example, the manager in charge of the audit should assign an individual to be the single point of contact responsible for setting up meetings with the client. Another role that should be assigned is the individual who keeps track of the status of the audit and staffing to avoid having individuals on the team working on the same tasks.
Set check-in times each day with the internal audit team to ensure the audit is still on schedule. These check-ins are critical to the success of a remote audit. Because the audit team is not in the same physical location, communication does not occur as often throughout the day. A set check-in time will help communication flow and keep the audit on track.
Start with less complex audits. Once internal audit has established its ability to perform simple audits off-site, it can transition to other complex areas later in the year. For example, an audit that typically can be completed off-site is electronic banking. The documents are usually electronic and can be sent securely, and the processes are less complex.
A more complex audit, like allowance for loan and lease losses (ALLL), should be performed on-site at first, to understand the complexities involved in the process as well as the complexities of the ALLL model. Internal auditors always should look at the audit plan and work with management to determine which audits would be more complex than others.
Embrace Established Technology Principles
It is no secret that technology is making life easier. By taking advantage of well-established technology principles, organizations and business leaders can transform business areas such as internal audit that often depend on manual processes. Innovations such as secure file sharing, video chats, and virtual private networks can facilitate remote audits that create flexibility and ease for both the client and the audit team.