Ready, Set, Remote Audits: Mastering the Art of Virtual Assessments

Additional resources

The Art of Remote Auditing

Two of the most significant challenges in remote auditing are enabling key relationships and accessing information. But remote audits do have numerous benefits.

ISACA® IT Audit Resources

Discover the latest IT audit publications, best practices, insights and training to enhance your processes and stay ahead of the curve in your IT audit career.

Building Unshakable Foundations: Why Effective IT Audit is Your Key to Cyber Resilience

Osman Azab previews his upcoming session at ISACA Europe Conference on enhancing cyber resilience through effective IT audit practices.

Key Considerations for Conducting Remote IT Audits

Conducting adequate preparation including risk assessments, assessing resource requirements and ensuring ongoing communication to harness both the benefits and to address the potential challenges faced when conducting hybrid or fully virtual audits.

In an era where management is calling employees back to the office, work flexibility is increasingly important in attracting and retaining talent. COVID abruptly forced many of us to work from home without proper preparation. Since then, teams have proven that they can perform remote audits efficiently and successfully with some adjustments. We will share some strategies and tips below for conducting successful remote audits.

Embrace a Digital Protocol and Shift to Digital Evidence

Remote audits call for a shift in standard procedures. Traditional methods like inquiry, inspection, and observation can be successfully conducted through virtual means. Consider the following:

• Utilize screenshares for walkthroughs
• Record meetings, where company policy allows, to focus on understanding. The recording can be played back for documentation later and summarized meeting notes may be generated via transcription functionality.
• Virtual meetings allow for greater flexibility in scheduling meetings

Say goodbye to bulky binders and manual signatures. Remote auditing leans heavily on digital evidence. Leverage the following support for audit documentation:

• Digital signatures and email evidence are acceptable forms of evidence
• Ensure screenshot evidence includes a timestamp date
• Send surveys via the audit platform for process narrative updates and year-end inquiries to identify any changes in processes, process owners, or systems

Manage Audit Requests

• Consider establishing a timeline for escalating unfulfilled requests and communicate to the team

As many auditors know, a common struggle is obtaining audit evidence in a timely manner. Following up on requests for information may be easier to do in person in the office, so remote auditors need to be persistent in managing audit requests. 

Maintain Communication and Engagement

To prevent feelings of isolation, especially among less experienced auditors, regular communication is key.

• Maintain periodic touchpoints
• Hold one-on-one meetings with direct reports, as well as team meetings
• Balance on-camera vs. off camera time to avoid Zoom fatigue
• Consider an annual in-person meeting to allow team members to meet and interact face-to-face
• Establish group chats to replace impromptu office watercooler conversations
• Shift auditee meetings to a virtual format for: kickoff/entrance meetings, status meetings, walkthrough meetings, and exit meetings
• Utilize surveys, SharePoint sites or audit request capabilities from a GRC audit platform to facilitate the collection of evidence

Set Boundaries

Remote work can sometimes blur the lines between professional and personal life. Auditors need to establish distinct boundaries between work and home life.

• Establish a daily routine and have a designated work space
• Be conscious of work start and end times
• Set core hours when the team is expected to be online, based on their time zone
• Utilize separate devices for work vs. personal use

Establish Virtual Meeting Protocols

Although virtual meetings allow for greater flexibility, proper meeting etiquette should be followed.

• Remind team members not to participate in video calls, where possible due to distractions and confidentiality concerns
• Consider creating a team virtual background to create solidarity
• Be mindful of having conversations in remote locations

Enhance Security and Technology

Security is critical in remote work, as data protection is more a focus.

• Enhance security by implementing virtual private networks (VPNs), multifactor authentication (MFA), and data loss prevention (DLP) software to monitor and protect sensitive information
• Ensure internet speed is adequate
• Require connection to the network to facilitate timely implementation of patches/upgrades

Use of Guest Auditors

Consider the use of guest auditors to perform remote audits, where appropriate to control costs and work around restrictive travel policies. Some key factors to evaluate in the use of a guest auditor include the following:

• Selection of the guest auditor—The selection process will depend on the qualifications needed to complete the audit.
• Physical proximity to the entity to be audited—The location of the audited entity will determine the feasibility of utilizing guest auditors.
• Time frame for auditor involvement—The audit manager must ensure that the time frame for the guest auditor is adequate for achieving audit objectives.
• Independence or potential conflicts of interest—Guest auditors should be required to disclose any potential conflict with the process under review. Ideally, a guest auditor should not audit a process they were directly involved with within the past year.

Guest auditors should be supervised similarly to managers’ direct reports. Additionally, they should receive appropriate training on internal audit methodologies and audit approaches to ensure successful execution of the audit.

Managing the Virtual Audit:

Virtual audits demand a shift in management style:

• Focus on on-time audit deliverables rather than monitoring physical presence
• Ensure expectations are clear and monitor audit status via thoughtful check-ins
• Use GRC tools for real-time progress tracking and status reporting to ensure clear communication and expectations

Limitations of Remote Audits

In some cases, a virtual audit may not be ideal or even possible. For example, a physical inventory may require the auditor to be onsite to ensure that all items in a warehouse are counted, to observe warehouse personnel counting the inventory, and to count items stored in multiple locations. Often, there is not an adequate internet connection in a warehouse environment. The auditor should carefully evaluate whether the audit objectives can be achieved in a virtual environment.

Conclusion

Adapting to remote audits is not just a necessity but a strategic advantage. By embracing digital protocols, managing evidence carefully, and maintaining strong communication, auditors can enhance their audit techniques while meeting the dynamic needs of today's workforce. As the auditing profession evolves, staying ahead with these strategies will be crucial in attracting and retaining talent in a competitive landscape.

For additional insights on this topic, read the ISACA Journal article, “The Art of Remote Auditing.”

Ayseli Sen, CISA, CRISC, CFE, CIA, CPA, CRMA

Is a Senior Director of Internal Audit at Windstream in Rochester, NY, USA

Farah Sammour, CISA, CRISC

Is a Director of Internal Audit at Frontier Communications in Rochester, NY, USA