Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​Site Audits in the COVID-19 New Normal

Environmental, health and safety, and sustainability auditors are finding new ways to adapt to restrictions on travel and site visits.

Comments Views

​COVID-19 — inherently a health and safety issue — has transformed our world, including virtually all aspects of how organizations do business. This is true for both third line internal audits and second line environmental, health and safety, and sustainability (EHSS) audits. 

The immediate response to the rapid spread of COVID-19 was to shut down everything, including large parts of organizations — many deferred or cancelled scheduled audits. As governing officials take steps to reopen the economy and organizations, they are best served by taking steps to evaluate safety, effectiveness, and value as they go. 

The same holds true for EHSS audits. Before considering aspects of audits that have changed — or should change — practitioners should revisit the EHSS audits themselves. 

EHSS audits still provide value to organizations. They help mitigate risks, identify opportunities, and provide comfort to management regarding the organization's ability to achieve its goals and objectives. EHSS auditors are finding ways to adapt to restrictions on travel and site visits. Some changes are already emerging as new best practices, and other changes are likely to come. 

Some terms describing the types of audits today include:

  • Remote audit. No auditor is at the facility. All necessary facility staff are at the facility.
  • Traditional or in-person audit. The entire audit team and all necessary facility staff are at the facility. 
  • Hybrid audit. At least one auditor is on site, and other auditors participate remotely. Some key facility staff may also be remote, but there is at least a primary contact person at the facility.

Several key observations and tips garnered through experience with remote or hybrid audits during COVID-19 can help practitioners looking to conduct site audits virtually.

Audit Segment: Planning

One of the biggest impacts of moving to a remote or hybrid audit approach is the need to spend significantly more time and effort in the planning phase — perhaps two or three times the level of effort.

Risk Assessment COVID-19 has changed many aspects of facility operations. The audit team leader should revisit EHSS risks and tailor the audit appropriately. Social distancing, personal protective equipment (PPE), and collection and disposal of used PPE are all areas of greater risk — some with compliance requirements — compared to just last year. Working from home can pose safety risks different from those associated with the traditional workplace.

Scope Audit scope may change, based on changes in operations and changes in EHSS risks and compliance. Some aspects of audits — notably document production and analysis — require more time. Either the hours an auditor spends on the job need to increase, or the scope of the audit needs to be more narrowly focused. Remote and hybrid audits require more time for document production and analysis. Auditors should identify and engage appropriate stakeholders — facility leadership, EHSS managers, and facilities and maintenance personnel — so they can identify an appropriate scope.

Communication Practitioners should communicate audit parameters early and often, especially if it is the facility's first remote or hybrid audit. They should clarify expectations for documents and persons to be interviewed, and work around client schedules. Moreover, communications should be two-way; the facility's primary contact should feel free to approach the auditor with questions, updates, or concerns. 

Audit Staffing One advantage to remote and hybrid audits is that it expands the field of prospective auditors. An auditor's location doesn't matter, and there are no travel costs. Audit leaders can tap the right auditors at the right time, such as enlisting a specialist for just a small portion of an engagement. This type of flexibility can add value, compensating for some of what may be lost through remote processes. 

Remote Document Review All parties to the audit must navigate the advance production of documents. The audit team may need documents for different reasons, such as to understand the sample set and conduct more detailed review and testing. Auditors should begin working on document reviews early — especially if the audit team consists of or includes consultants — because IT, legal, and other parties may need to get involved. 

Time Allowance Experience suggests that all segments of remote audits — planning, field procedures, and reporting — tend to be more iterative than traditional audits. Auditors can't just walk to the control room to ask the operator a quick follow-up question, or confirm initial impressions of something they saw in the introductory tour. They should allow more time for the audit. 

Audit Segment: Audit Procedures  

Remote and hybrid audits both present challenges for the "field procedures" from start to finish. EHSS auditors have found ways to make the best of these challenges and still produce valid audits. 

Facility Tour Traditional EHSS audits typically start with a short opening meeting and a facility tour. These steps help familiarizes the audit team with the site, operations, who works where, and aspects of EHSS on which the audit will focus. Alternative methods that have worked well include:

  • Live streamed facility tour. This approach has the advantage of being most like a traditional facility tour and takes the least amount of pre-work. Technology can pose limits, including the time investment to understand it (for both facility staff and the auditors), limited bandwidth or reception at the facility, and limited ability for dialog between the auditors and facility staff. 
  • Prerecorded, narrated video tour. This method eliminates the transmission quality issues often encountered during a live-streamed tour. It can also be shared prior to the start of field procedures. The downside of this approach is that it takes more preparation time and effort by the facility personnel. General tech savviness and comfort using video recording technology can vary among those creating the video content.
  • Still photos or short video snippets. This approach allows facility personnel to capture digital photographs and short video clips, sometimes combing them to create a single "digital move." It takes the least amount of tech awareness — most people are now familiar with the use of cell phone cameras for photo and video capture — but challenges can include capturing sufficient information to provide context for the audit team, as well and determining a logical way to sequence the information.

Collection of Evidence Naturally, the collection of evidence, whether through direct observation or document and data review and interviews, is different when all or most of the team — and possibly some key facility personnel — are not present at the facility.

  • Documents. Because the auditor is not on site to thumb through file cabinets and decide what is or is not relevant, deciding how to upload documents in the planning stage is key to document review success. Auditors should schedule appropriate review time for documentation to allow for an in-depth review without taking the time of facility personnel. A document request and production tracking mechanism is customary in traditional audits, but it is also essential for remote and hybrid audits. Auditors should be sure to use exact document titles or file names, keeping in mind that everyone isn't in the same room to resolve confusion. 
  • Interviews. Remote and hybrid audits call for adjustments in planning interviews with facility personnel. Auditors should allow extra time between interviews, factoring in the possibility of problems with technology. Interviewing remotely has inherent limitations, as a significant portion of communication is nonverbal. These limitations should be mitigated by using video-communication technologies and live document sharing.
  • Visual observations. Auditors need visual observations for testing per the initial scope, or to follow up on document reviews and interviews. The same approaches can be used as were described for the facility tour. Visual observations may consist of still digital photographs of equipment (guarding, for example) or videos taken of in-process activities (a 10-minute video of an intersection where pedestrians and forklifts share the space, or a 30-minute video of a lockout/tag-out procedure). Auditors and facility personnel should also realize that there may be different dynamics and pressures for photography and video recording than for an on-site visual observation; employees may not be comfortable being photographed or recorded, for example. In some circumstances, this may trigger privacy laws or, if the workforce is unionized, applicable provisions.

Audit Segment: Reporting and Follow-up

Traditional audits typically include a closing meeting followed by draft report delivery, review, and finalization. This process is the least affected by shifting to a remote or hybrid approach, but nevertheless there are keys to success. 

Periodic Debrief Meetings As with any type of engagement, auditors should avoid surprises during remote work. The audit team should make special efforts to communicate findings and observations as the audit progresses. Periodic debriefs, whether daily or at some other interval, should be scheduled with the audit team and key stakeholders so that developing issues and challenges to findings can be identified and discussed.

Closing Meetings The audit team will need time to coalesce all of its information and identify any key messages that need to be highlighted. The closing meeting may need to be scheduled at some interval after the conclusion of the remote or hybrid audit period.

Follow-up Visits Traditional verification audits to verify sufficiency of corrective actions will suffer from the same limitations as the audits themselves. If a remote or hybrid audit identifies a significant compliance or risk issue, it could warrant provisions for more intense remote or hybrid exercises, or even an on-site visit to validate corrective actions and the effectiveness of controls.

Redefining Normal

COVID-19 has forced the world, including EHSS auditors, to adopt new ways of working. Organizations are now performing remote and hybrid audits to fulfill the objectives of EHSS programs. Even when the current pandemic has run its course, the idea of what constitutes "normal" will change. Remote and hybrid audits will be a part of it, especially now that companies have noted reductions in travel costs and the associated benefits of reducing greenhouse gas emissions. 

Now is the time for practitioners to adapt their EHSS audit approach and make sure their team continues to deliver value by constructively adapting to current drivers and risks, leveraging technology, and seeking new ways to provide assistance.

To learn more about COVID-19's impact on EHSS auditing, read the Environmental, Health & Safety Audit Center's Knowledge Brief, COVID-19: A Driver to Transform EHSS Audit Programs.

Roy Litzenberg
Douglas Hileman
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Authors

 

 

Roy LitzenbergRoy Litzenberg<p class="MsoNormal" style="margin-bottom:0.0001pt;line-height:normal;"><span style="color:black;">Roy Litzenberg, CPEA, is an ES&H audit manager at Koch Industries in Wichita, Kan.<br></span></p>https://iaonline.theiia.org/authors/Pages/Roy-Litzenberg.aspx

 

 

Douglas HilemanDouglas Hileman<p>​Douglas Hileman, CRMA, is president and founder of Douglas Hileman Consulting LLC in Van Nuys, Calif.</p>https://iaonline.theiia.org/authors/Pages/Douglas-Hileman.aspx

 

Comment on this article

comments powered by Disqus
  • AuditBoard-May-2021-Premium-1
  • Awareness-Month-May-2021-Premium-2
  • Virtual-IC-May-2021-Premium-3