Remote Auditing Success Across the Audit Cycle

“ <ul> <li><u><strong>An expanded pool of available auditors and subject matter experts:</strong></u> “If you are not necessarily stuck to one location, you can expand your coverage. You can bring your subject matter experts that are not necessarily in the same location, and they may have more availability because they can be working on a few clients or few engagements at the same time. But yet you still get the advantage of having that expertise when you need it by working remotely.”</li> <li><u><strong>Expanded coverage and reduced travel costs:</strong></u> “You have a lot of opportunities and that comes with reduced travel costs. If you had budget limitations in terms of travel, now you can accomplish more than you ever could. The burden to the audit customers is less, because you can give them more time to prepare information. You don’t have to have a lot of auditors on site. It feels lighter to a certain extent and at the same time documentation can also be easily obtained.”</li> <li><u><strong>Improved use of available technology strengthens documentation and reporting:</strong></u> “If you’re using technology that makes information centrally available, then you reduce some of that duplication of effort. If you have external auditors that are looking for the same information, you can have one repository that can be accessed by all auditors. Fewer questions, fewer requests from your auditors on the audit customers. This really, really goes a long way speaking of building relationships.”</li> </ul> ”

“ <ul> <li><u><strong>First-hand observations cannot always be replaced by virtual observations:</strong></u> “Yes, there are cameras, mobile devices, and conference calls. Let’s take the example of physical inventories and physical observations. <strong>It sounds pretty simple. I’m going to replace my in-person auditor with somebody at the location</strong> who’s going to be walking around on site with a cellphone on FaceTime or a Teams meeting. <strong>Then they start actually walking around and you realize that you have reception issues or dead spots at that site. How do you overcome that?</strong> Are you able to achieve your audit objectives? Are you able to observe what you typically would observe on site? Do you know that the person who is walking around with that device is showing you everything you really want to see? Are there spots that they want you to avoid? You can’t fully control that. <strong>However, with the right preparation and the right testing, you should be able to achieve most, if not all, of your objectives.</strong> In this case, I would say work with the location in advance so you don’t test your technology for the first time when you have to do your observations. If you identify some challenges, at least you have time to figure out Plan B or work with your IT team to figure out what could be fixed.”</li> <li><strong><u>Remote auditing makes it hard to build relationships:</u> “</strong>It’s true. It’s not the same as being in person and getting to have those informal conversations. But another important <strong>drawback of virtual is not being able to provide some of the value-add tips and recommendations.</strong> You may be focused on one audit area, but when you are on site, you may see other opportunities that you recall seeing at other locations, or just from your experience you may want to share and recommend how to do things better. <strong>We’re losing that element of additional value-add recommendations that are not even necessarily part of your audit scope of work, but could be really helpful to the auditees.</strong> And this typically is what gives us that strong bond to build a relationship and not be seen as just auditors who are here to do their job and they don’t really care about my work.”</li> </ul> ”

“Planning is very important in general, but when you have a remote audit, you need toallocate more time to plan and think through all the elements. What are the limitations of the remote audit? What do you need to let your stakeholders know? What is the difference between being onsite in person versus remote audit?”

“We don’t always think about this when we request something, but it can take longer to provide some documentation electronically — especially if you’re in an organization that has relied on paper-based support. If you’re in an environment that historically has been automated and electronic, it’s probably not as much of a shift. Still, you should think about how long it’s going to take to scan certain information, especially if it’s multiple pages, double-sided, and maybe not a format that’s easily scanned — it does create an extra burden on your auditees. Allow for more time and be humble and appreciative when making your request.”

“For site visits, I cannot stress enough the value of advanced preparation. Think about how you can do your testing, who should be engaged, and make sure that you’re prepared. There could be limitations to the extent that you wouldn’t feel comfortable performing your audits. That’s going back to planning — but there is a possibility that you may realize that you have to be on site and you cannot get around it. We can’t just say, ‘I’m not going to perform this audit step because I can’t use the technology efficiently to cover it. I’m going to think about it when the times are better.’ No, we still have responsibility to provide specific coverage. You either have to make sure that there’s an understanding of the limitations and what cannot be done, or whether there is a possibility that you need to go on site.”

“Depending on your company culture and environment, your customers and yourselves may not be used to video calls. I can speak from my experience, we were not really big on video calls pre-COVID, and then we adopted technology and over time different people gained different levels of comfort. People are adapting to being on video calls. If you can, I would encourage the video calls for remote interviews because hearing a voice is one thing, but having some visual cues for your interviews is really helpful. This is the next best thing to having in-person conversations. The ability to see how people interact, how they are acting, their eye contact, anything else that potentially may raise red flags for you — you cannot pick up these cues on the voice calls.”

“Closing meetings require a similar approach when remote as they do in person in terms of having your testing done and your documentation reviewed. Make sure you organize your preliminary findings or preliminary report — I know there’s a big spread of what you’re presenting. Whatever it is you are doing at the end of your reviews, have a good draft of that, and have a good productive conversation during your closing meeting that you have shown and demonstrated that A) you prepared, B) you value the time of your audit customers, and C) you use that remote video conference call very wisely and you’re not wasting anybody’s time. I feel that when we’re remote, there is definitely less tolerance for being unprepared than when you’re on site. I think that there is never an excuse for being unprepared, but when you’re virtual it’s even more visible if something like that happens.”

“Some of the ways that you can stay on top of what’s happening in your organizations while remote, in terms of compliance or any changing business is check in with your business owners about what’s happening in their area. How are things changing? It should be a regular conversation. It shouldn’t be a check-the-box once a year or once in a blue moon. You have to make an effort tostay connected when you’re remote — be proactive, but also don’t sound too aggressive. Your purpose is to learn. Make it clear that you are trying to understand what’s happening in each business area so that you can proactively think about what skill sets you need or how much time you need to allocate to cover certain areas. You can also identify certain areas you didn’t even know about that may be worth covering either from an auditing or consulting type engagement perspective.”

““Collaboration is the key. We talked about the built-in relationship is one of the biggest challenges here. Here’s one of the tools. You proactively reach out, you say what you have to offer. You listen, and circle back and understand how you can help that specific area. You may have some examples or innovative ideas as to how you can help that specific business area be better. It could be something you’ve seen others do. It could be something from your own experience, but sharing your knowledge helpsmake internal audit a valued partner rather than being check-the-box, and somebody who’s working remotely and doesn’t have a name or face associated with them, just viewed as the cut-and-dry audit shop that nobody really wants to deal with.””

““Communication remotely has been challenging for a lot of people, especially if you don’t have the visual aspect. You have emails, you have phone calls, and you have to be very careful with how you craft your messages. How do you speak with your key stakeholders? What’s the follow-up process? Do you know how they receive information better? Do you know what kind of communication they prefer? Help your less-experienced auditors craft messages and explain what matters. Have a “less is more” attitude, especially when you have a lot of emails and a lot of requests — keep the messages clear and very succinct so that your recipients don’t have to read through a lot of long emails to understand what’s being asked of them. At the same time, it’s important to be polite. We’ve seen a lot of short messages that are not very nice. Remember that we’re still all humans, and we are appreciative of nice tones in emails and phone calls. Communication is definitely something we’ve been always working at and helping each other to improve. If you have audit reports, have your peers read the reports. If you have important emails, have somebody else review it and make sure that the tone is good and your message makes sense to somebody who was not into the details — make sure they can pick up your report and understand exactly what you’re saying.””

““Think about new risks, new business changes. What does it mean to your organization? What does it mean to your internal audit plan? What does it mean to your skill sets? Talk about some of thehigh risk areas that are not currently covered. They may not be covered for multiple reasons, but it’s important to have that open conversation with your executive team and the audit committees. If you identified risk areas or new areas that do require some audit coverage, you have to talk about what’s needed to address. Are you running out of time? You don’t have enough people. Do you not have additional resources that have that subject matter expertise? Do you need to hire people with certain expertise? Do you need to bring in subject matter expertise, and think about how to close those gaps. I always say, it’s not a good answer to say, ‘I’m not going to look into this area because I don’t have the right skill set.'””

““All of these tools can be helpful for you to move your audit function forward — to advance your skill set, to advance your technology needs. As a chief audit executive or audit leader, you have to take the actions.””