As people around the world continue working from home during the COVID-19 pandemic, internal auditors are adjusting to the challenges of virtual engagements. And while remote auditing is certainly not a new concept, the current vast number of practitioners — and their clients — all working this way at the same time has forced audit functions to consider how to work best when the parties involved are not physically present.
Successful remote auditing requires acknowledging and addressing the ways in which remote engagements differ from traditional on-site approaches. In other words, it is impossible for auditors to change only their physical location while trying to keep everything else the same and expect to successfully manage without in-person access. Instead, auditors must embrace and accept the unique benefits and challenges of working virtually. Whether auditing from home or an office, managing remote engagements requires specific logistical considerations and balancing the needs of multiple stakeholders.
Assess Suitability of the Engagement
Under ordinary circumstances, one of the keys to a successful remote audit is determining in advance whether a given engagement is an appropriate candidate for remote auditing. Not all audits are equally well-suited to a remote approach. For example, a financial statement audit is a better candidate than a review of a facility's physical security controls — the former consists primarily of documentation review and data analysis, whereas the latter requires not only testing of controls on site but the presence of the auditor to get a sense of the larger security environment. Regardless, auditors should evaluate the suitability of the engagement with an open mind, on a case-by-case basis. Some important considerations for weighing remote versus on-site auditing include:
- Cost savings.
- Audit resources (location, remote audit experience, number of auditors required, availability, etc.).
- Types of procedures to be performed.
- Types of evidence that can be obtained remotely based on technology capabilities.
- Security of communications and data transfers.
In the extraordinary circumstances surrounding the COVID-19 pandemic, auditors are faced with what to do when in-person or on-site procedures are not an option. When considering individual procedures, auditors have four basic choices:
- Execute the procedure as designed from a remote location (e.g., document review).
- Substitute a modified, remote version of the procedure (e.g., virtual interviews).
- Postpone the procedure (with impact to audit timeline/delivery).
- Remove the procedure (with impact to audit scope/objectives).
Before delving into the procedures, internal audit should first review the engagement objectives. In alignment with The IIA's Implementation Guide 2210: Engagement Objectives, internal auditors should "attain a complete understanding of why the engagement is being conducted and what the organization aims to achieve." Looking at the individual procedures through the lens of the audit's purpose and objectives helps to ensure that choosing between the four options listed above is done effectively and responsibly. Plus, in a crisis situation, such as a global pandemic, it is quite possible that management's perception of key risks around a particular business area have changed, so the objectives themselves should be reviewed to ensure they are appropriate based on current risk and the needs of the business.
Along with assessing the engagement' suitability for a virtual approach, the auditors themselves should be considered as well. During the COVID-19 pandemic, many auditors have had no choice but to remain off-site and do the best they can under the circumstances. But normally, auditor skills and preferences may also be a contributing factor when considering a remote approach. Remote procedures benefit auditors in terms of schedule flexibility, reducing travel, and allowing them to work where they are comfortable and have access to familiar surroundings and technology. But there may be some cases where the auditor feels more comfortable performing the audit on site, and practitioner comfort can potentially impact the quality of the procedures performed. Also, the adoption of remote procedures may impact internal audit resource decisions as it relates to specialization versus generalization, as virtual audits may enable the audit function to leverage a particular auditor's skills across a larger number of different engagements.
Adjust the Engagement Plan
When auditors choose a remote approach for an engagement that has historically included an on-site or in-person component, they must review the engagement's audit plan and revise accordingly. In particular, practitioners should pay close attention to the audit timeline and schedule, as certain activities may take more time or less time than with an on-site engagement. For example, it may take longer for a person to reply to a question via email than to respond face-to-face. Internal audit management also must think about how the engagement fits into the larger audit plan. Will the auditors be working on more than one audit simultaneously? If so, which ones make the most sense to fit together? Does the team composition still make sense for a virtual audit, or is there a gap or overlap?
The order of procedures and deliverables also should be considered. If the remote approach is new, particularly if it is replacing an on-site audit, stakeholders may want to see incremental results earlier or more frequently. Or, clients may have heightened interest from a risk perspective around key performance indicators as compared to process documentation or other controls reviews, potentially affecting the order in which auditors choose to perform procedures. In a crisis situation such as a pandemic, auditors should also be aware that usual business processes may have changed for the business area, so the audit plan should reflect those changes as well.
Communication and Stakeholder Acceptance
Aside from the audit process itself, stakeholder acceptance is also an important aspect of managing remote/virtual audits. The subject of the audit, other internal stakeholders, and third parties may have various reasons for being more or less open to the idea of remote audit. For example, for the subject of the audit, virtual work may alleviate some of the burden of accommodating on-site auditors but increase the burden of managing e-communications. For senior management, remote auditing may increase efficiency but still raise concern about sacrificing the direct visibility that comes from having auditors on site. Moreover, some third parties — such as regulators — may not accept remote audits under normal circumstances.
As with any change management effort, proactive communication is critical to increasing comfort level and earning support. With the COVID-19 pandemic, auditors are having to think outside the box to obtain audit evidence. It may be helpful to explain new procedures and map them to old ones (if applicable). Auditors may go further to provide a proof of concept demonstrating how virtual procedures can accomplish the audit objectives. Communicating proactively with key stakeholders in this way will help to ensure that everyone's expectations are aligned.
In terms of interpersonal communication, limiting or eliminating face-to-face contact changes the dynamics of an engagement. When the nonverbal cues present during in-person conversation are removed from the equation, so too is valuable information about the progress and overall success of the audit and potential areas of concern. Auditors should be mindful of this when considering the engagement's communication plan. For example, when working remotely, auditors may want to provide more explicit instructions about what they want from the audit subject than when they are working side-by-side with them. This helps to reduce unnecessary follow-up questions and rework. Meanwhile, auditors may need to provide more lead time in communicating when certain resources from the business area will be needed and should be made available. From a logistical standpoint, auditors should work with those in the business area to determine what modes of communication (i.e., video, voice, email, etc.) make the most sense for the various aspects of the audit in terms of comfort, efficiency, and security.
Adapting to a Virtual World
During this time when so many auditors are being asked to work from home, there are many steps they can take to enhance the success of remote engagements. Communicating regularly with colleagues and clients, and being open to flexibility in working approaches, can help address the challenges of what has been, for many, an unexpected change of circumstance.