In this episode of AuditTalk, Yulia Gurman, Executive Director of Internal Audit and Corporate Security at Packaging Corporation of America (PCA), dives into findings from The Remote Auditor, a recent survey report from the Internal Audit Foundation and AuditBoard that assesses the impact of remote work on the internal audit profession. In an information-packed presentation, Yulia shares her best practices and real-world examples of how to sustain a positive virtual work environment for internal audit and its stakeholders, including:
- How PCA’s audit team capitalizes on a remote environment’s advantages to expand talent, audit coverage, and technology use, and overcomes the challenges that accompany virtual observations and relationship-building.
- Practical tips and examples for success across the remote audit cycle — from planning and document review to site visits, remote interviews, and closing meetings.
- Keys for collaboration and communication while remote, including how to run a productive virtual meeting, strike the right tone in emails, and work together to improve the team’s communication skills.
Watch the video for a wide range of real-world examples of how to approach auditing in a remote or hybrid environment, and read the can’t-miss highlights below.
How to Seize Remote Audit Advantages and Overcome Challenges
“Let’s talk about the good things that come with remote audit. As with any change, it could be more painful or less painful depending on your staff and your organization, but there’s always some advantages. Let’s talk about a few of them.”
- An expanded pool of available auditors and subject matter experts: “If you are not necessarily stuck to one location, you can expand your coverage. You can bring your subject matter experts that are not necessarily in the same location, and they may have more availability because they can be working on a few clients or few engagements at the same time. But yet you still get the advantage of having that expertise when you need it by working remotely.”
- Expanded coverage and reduced travel costs: “You have a lot of opportunities and that comes with reduced travel costs. If you had budget limitations in terms of travel, now you can accomplish more than you ever could. The burden to the audit customers is less, because you can give them more time to prepare information. You don’t have to have a lot of auditors on site. It feels lighter to a certain extent and at the same time documentation can also be easily obtained.”
- Improved use of available technology strengthens documentation and reporting: “If you’re using technology that makes information centrally available, then you reduce some of that duplication of effort. If you have external auditors that are looking for the same information, you can have one repository that can be accessed by all auditors. Fewer questions, fewer requests from your auditors on the audit customers. This really, really goes a long way speaking of building relationships.”
“There are also some limitations that we may have as we are covering our audit plans remotely.”
- First-hand observations cannot always be replaced by virtual observations: “Yes, there are cameras, mobile devices, and conference calls. Let’s take the example of physical inventories and physical observations. It sounds pretty simple. I’m going to replace my in-person auditor with somebody at the location who’s going to be walking around on site with a cellphone on FaceTime or a Teams meeting. Then they start actually walking around and you realize that you have reception issues or dead spots at that site. How do you overcome that? Are you able to achieve your audit objectives? Are you able to observe what you typically would observe on site? Do you know that the person who is walking around with that device is showing you everything you really want to see? Are there spots that they want you to avoid? You can’t fully control that. However, with the right preparation and the right testing, you should be able to achieve most, if not all, of your objectives. In this case, I would say work with the location in advance so you don’t test your technology for the first time when you have to do your observations. If you identify some challenges, at least you have time to figure out Plan B or work with your IT team to figure out what could be fixed.”
- Remote auditing makes it hard to build relationships: “It’s true. It’s not the same as being in person and getting to have those informal conversations. But another important drawback of virtual is not being able to provide some of the value-add tips and recommendations. You may be focused on one audit area, but when you are on site, you may see other opportunities that you recall seeing at other locations, or just from your experience you may want to share and recommend how to do things better. We’re losing that element of additional value-add recommendations that are not even necessarily part of your audit scope of work, but could be really helpful to the auditees. And this typically is what gives us that strong bond to build a relationship and not be seen as just auditors who are here to do their job and they don’t really care about my work.”
Considerations for Remote Auditing Across the Audit Cycle
“Remote planning, interviews, site visits, testing — none of this is new, but we must be very thoughtful in our approach in a virtual environment.”
“Based on the surveys, most of us are either fully remote or hybrid, and only a small percent returned back fully in person and are performing their audits in person. Thinking about remote considerations: What should we be changing? What should we be thinking about as we plan our remote audits? Here are some examples of the considerations that were published in Remote Auditing for COVID-19 and Beyond by Roy Litzenberg and Carrie Ramirez.”
Planning
“Planning is very important in general, but when you have a remote audit, you need toallocate more time to plan and think through all the elements. What are the limitations of the remote audit? What do you need to let your stakeholders know? What is the difference between being onsite in person versus remote audit?”
“Planning really changed for us during remote auditing. As an example, we used to have a group of people going to the plants. Now that we have the opportunity to work remotely, people work on multiple areas at the same time. You may actually have more people working on some targeted areas — or vice versa, maybe some audits could involve fewer people than traditionally. You have the ability to mix and match, but you have to explain to your audit customer what it means to them. Are there traditional expectations changing? Is the timeline of the audit going to change? What is going to happen? The more answers you provide upfront, the easier it’s going to be to conduct the audit.”
“You’ll also want to talk about technology use, what has changed from last time you’ve been at that location if it’s historically been done on site. In our case, we did adopt technology and we automated the documentation requests and a lot of different aspects for our audit customers. We made sure we provided technology training so that they knew what the expectation is and where they should be uploading the information — the process goes way smoother this way.”
Document Review
“We don’t always think about this when we request something, but it can take longer to provide some documentation electronically — especially if you’re in an organization that has relied on paper-based support. If you’re in an environment that historically has been automated and electronic, it’s probably not as much of a shift. Still, you should think about how long it’s going to take to scan certain information, especially if it’s multiple pages, double-sided, and maybe not a format that’s easily scanned — it does create an extra burden on your auditees. Allow for more time and be humble and appreciative when making your request.”
“Be open to a different format of information than you’re used to. As long as you get what you need, be prepared to have slightly different versions of this information. A soft copy may not be exactly what you were used to seeing, or maybe they’ve changed their ways of performing certain controls. Ideally if you’re dealing with the controls it should be addressed during the design, but if it’s an operational audit some things may be coming up as you are covering your specific areas of planning and requesting documentation. You need to have flexibility: how are you going to look at the data? How are you going to review the data? This is the opportunity to rethink your audit approach and data review for some types of information.”
Site Visits
“For site visits, I cannot stress enough the value of advanced preparation. Think about how you can do your testing, who should be engaged, and make sure that you’re prepared. There could be limitations to the extent that you wouldn’t feel comfortable performing your audits. That’s going back to planning — but there is a possibility that you may realize that you have to be on site and you cannot get around it. We can’t just say, ‘I’m not going to perform this audit step because I can’t use the technology efficiently to cover it. I’m going to think about it when the times are better.’ No, we still have responsibility to provide specific coverage. You either have to make sure that there’s an understanding of the limitations and what cannot be done, or whether there is a possibility that you need to go on site.”
Remote Interviews
“Depending on your company culture and environment, your customers and yourselves may not be used to video calls. I can speak from my experience, we were not really big on video calls pre-COVID, and then we adopted technology and over time different people gained different levels of comfort. People are adapting to being on video calls. If you can, I would encourage the video calls for remote interviews because hearing a voice is one thing, but having some visual cues for your interviews is really helpful. This is the next best thing to having in-person conversations. The ability to see how people interact, how they are acting, their eye contact, anything else that potentially may raise red flags for you — you cannot pick up these cues on the voice calls.”
“You also want to make sure you use your time wisely. It’s much easier to connect with people when you’re on site: you can pop in and ask a question, leave, and then you may return with a few more questions. When you’re remote, it still requires preparation, planning, and making sure you put a meeting on a calendar with people who are busy. Preparation, preparation, preparation. This is where you win over your customers: you have efficient conversations and minimize that follow up. I think this is a number one feedback item that I’m hearing in some of our engagements is that there is a lot of follow up. Can we organize this? Can we have one conversation? Make sure you summarize everything you need, because if it seems like there’s a lot of different follow-up items coming from different people, it could get frustrating.”
Closing Meetings
“Closing meetings require a similar approach when remote as they do in person in terms of having your testing done and your documentation reviewed. Make sure you organize your preliminary findings or preliminary report — I know there’s a big spread of what you’re presenting. Whatever it is you are doing at the end of your reviews, have a good draft of that, and have a good productive conversation during your closing meeting that you have shown and demonstrated that A) you prepared, B) you value the time of your audit customers, and C) you use that remote video conference call very wisely and you’re not wasting anybody’s time. I feel that when we’re remote, there is definitely less tolerance for being unprepared than when you’re on site. I think that there is never an excuse for being unprepared, but when you’re virtual it’s even more visible if something like that happens.”
Strategies to Meet New Priorities
“Some of the ways that you can stay on top of what’s happening in your organizations while remote, in terms of compliance or any changing business is check in with your business owners about what’s happening in their area. How are things changing? It should be a regular conversation. It shouldn’t be a check-the-box once a year or once in a blue moon. You have to make an effort tostay connected when you’re remote — be proactive, but also don’t sound too aggressive. Your purpose is to learn. Make it clear that you are trying to understand what’s happening in each business area so that you can proactively think about what skill sets you need or how much time you need to allocate to cover certain areas. You can also identify certain areas you didn’t even know about that may be worth covering either from an auditing or consulting type engagement perspective.”
“Collaboration is the key. We talked about the built-in relationship is one of the biggest challenges here. Here’s one of the tools. You proactively reach out, you say what you have to offer. You listen, and circle back and understand how you can help that specific area. You may have some examples or innovative ideas as to how you can help that specific business area be better. It could be something you’ve seen others do. It could be something from your own experience, but sharing your knowledge helpsmake internal audit a valued partner rather than being check-the-box, and somebody who’s working remotely and doesn’t have a name or face associated with them, just viewed as the cut-and-dry audit shop that nobody really wants to deal with.”
“We have to teach our newer team members on how to accomplish this. For those of us who have been with organizations for a long time, we have an advantage because we’ve built the relationships prior to being remote. People know who we are, and we know who people are. Use that knowledge and help your newer team members. I know a lot of us hired people during the remote environment — share with your team who people are, what’s the best way to reach out so that they’re successful in building relationships. At the end of the day, your project lead or audit lead are going to be the ones who will have to build those relationships with the customers to have smoother audits, to get that call where the customer says, ‘Hey, I want you to come back and look into this area,’ or, ‘I know you gave me some valuable information before, can you take a look at this?’ Those are the types of requests we want to see as audit leaders. That’s what speaks to the high quality of your audit talent and the result of the work that you provide that is really valued.”
“Communication remotely has been challenging for a lot of people, especially if you don’t have the visual aspect. You have emails, you have phone calls, and you have to be very careful with how you craft your messages. How do you speak with your key stakeholders? What’s the follow-up process? Do you know how they receive information better? Do you know what kind of communication they prefer? Help your less-experienced auditors craft messages and explain what matters. Have a “less is more” attitude, especially when you have a lot of emails and a lot of requests — keep the messages clear and very succinct so that your recipients don’t have to read through a lot of long emails to understand what’s being asked of them. At the same time, it’s important to be polite. We’ve seen a lot of short messages that are not very nice. Remember that we’re still all humans, and we are appreciative of nice tones in emails and phone calls. Communication is definitely something we’ve been always working at and helping each other to improve. If you have audit reports, have your peers read the reports. If you have important emails, have somebody else review it and make sure that the tone is good and your message makes sense to somebody who was not into the details — make sure they can pick up your report and understand exactly what you’re saying.”
Audit Leaders Must Take Action
“Think about new risks, new business changes. What does it mean to your organization? What does it mean to your internal audit plan? What does it mean to your skill sets? Talk about some of thehigh risk areas that are not currently covered. They may not be covered for multiple reasons, but it’s important to have that open conversation with your executive team and the audit committees. If you identified risk areas or new areas that do require some audit coverage, you have to talk about what’s needed to address. Are you running out of time? You don’t have enough people. Do you not have additional resources that have that subject matter expertise? Do you need to hire people with certain expertise? Do you need to bring in subject matter expertise, and think about how to close those gaps. I always say, it’s not a good answer to say, ‘I’m not going to look into this area because I don’t have the right skill set.'”
“All of these tools can be helpful for you to move your audit function forward — to advance your skill set, to advance your technology needs. As a chief audit executive or audit leader, you have to take the actions.”
Looking for more thought leadership? Check out our on-demand webinar library, and stay tuned for more AuditTalk videos featuring audit community leaders about industry issues, insights, and experiences.
