⏱ 6 min
Opportunities and challenges in a dynamic environment
When the Federal Council declared an “extraordinary situation” on 16 March 2020 and public life in Switzerland came to a standstill, the private lives of many people changed virtually overnight - and so did the world of work. Internal audit, as a profession, has not been spared the effects of the coronavirus crisis and will also have to adapt to the changed circumstances. Even today, more than a year and a half later, home office recommendations and travel and contact restrictions are making it difficult to conduct internal audits in the field. In such an environment, it is hardly surprising that so-called remote audits are becoming more and more popular, with internal audit remits being carried out digitally and by video telephony as far as possible. The benefits and challenges of remote audits are discussed below, along with the things to look out for during planning and performance.
Up to now, audits have generally been conducted on site at the organisation being audited. Although portions of audits have been remote in the past, this has mostly been in a preparatory, follow-up or supporting function. This has included, for example, processing data, evaluating samples or performing selected reporting tasks. Internal audit has now been also been forced to adapt to the circumstances and conduct not just parts of audits but entire audits remotely. The coronavirus crisis has created entirely new challenges and risks for companies. Examples include updated processes and communication channels due to home office setups, supplier changes in case of delivery bottlenecks, or the failure or reduced effectiveness of control mechanisms (e.g. dual control principle in the case of no-contact orders or restricted access to technical equipment). This confluence of emerging risks makes audits all the more important.
Advantages of remote audits
One immediately obvious advantage of remote audits are the time and cost savings due to eliminating long travel distances and accommodation costs. This makes remote audits more financially attractive, while the reduced travel involved also helps to protect the environment. Auditors may also be more readily available as a result, which translates into greater flexibility when scheduling audits. It additionally creates the possibility of involving other experts in the audit on a selective basis if necessary (e.g. interdisciplinary experts), and also makes it easier to offset staff shortages. For the audited entity, this provides more leeway when it comes to making all key people available for interviews within a very short time window and reduces the risk that this process could hamper daily business. The burden on the teams or companies being audited is lower as a result since they can be interviewed for the audit on a very targeted and more flexible schedule.
Eliminating travel also opens up new perspectives for audit firms and their employees in terms of co-sourcing and outsourcing mandates. Employees who are reluctant to travel for extended periods of time due to family commitments or other reasons can be deployed on remote audits and thus continue to contribute their expertise.
Challenges of remote audits
The lack of face-to-face contact with the entity under audit can be a barrier to the open exchange of information. The personal interaction enables a basis of trust, which is necessary for obtaining the relevant information. In addition, the body language and facial expressions of the interlocutor are an important part of communication. Remote audits require an even higher degree of preparation than on-site audits. Solid preparation forms the basis for an efficient audit and builds confidence, as it allows the audited entity to prepare for what is to come. In order to allow sufficient time for both the unit being audited and the auditors to make the necessary preparations, particular care should be taken to provide adequate notice of the audit. The challenge here is that if the audit is announced too early, this could result in documents being “optimised”. This weakness of remote audits is also apparent when it comes to inventory or security. Since inspections cannot be carried out on site, the most that can be done is to verify this via video telephony or pictures. This harbours the risk that images or data could be falsified.
Further challenges within the context of remote audits are mainly of a technical nature. To begin with, it's possible that the IT systems of the auditors and the entity being audited are incompatible, or that data files cannot be accessed due to IT security policies. Secondly, a lack of knowledge of the systems or features of the communications tools used, such as Microsoft Teams, can hinder the efficient and effective performance of the audit. This is also the conclusion of a study by Eulerich et al. (2021), which examined the success factors of remote audits.
The above-mentioned aspects, and in particular the potential for falsification and manipulation, can lead to a decline in assurance - i.e. the security or reliability of an audit. This is likewise reflected in the study findings of Eulerich et al. (2021). The authors surveyed stakeholders on their perceptions of remote audits and found that not only are stakeholders satisfied with remote audits, but also that there is general support for them. However, remote audits are viewed neutrally by stakeholders in terms of their reliability. The survey comprised audited entities, members of audit committees and members of management.
However, a lesser perception of the reliability of remote audits does not mean that remote audits are not possible or that the results are not usable. It is important to assess the situation at hand, to adapt your own course of action and to consider the aspects outlined below when preparing and conducting remote audits.
What to look out for during remote audits
Preparation is particularly important during remote audits. Preparation also involves ensuring that you have the appropriate infrastructure in place to conduct a remote audit. This includes reliable bandwidths for the rapid transmission of data and especially for the smooth processing of online interviews. It also needs to be defined in advance which channels will be used for communication and which tools will be applied for exchanging data. It is likewise important to test whether both parties have access to the IT systems.
A clear schedule of which interview will take place when, as well as a clear and structured agenda for the interviews themselves, set by the auditors, ensures that the process is as smooth as possible. It should be noted that the attention span for online interviews is usually shorter than for in-person interviews. With that in mind, online interviews should not be longer than one to one-and-a-half hours to obtain high-quality statements. If you are conducting a remote audit in a foreign-language country, it's a good idea to have a person who speaks both the local language and English present for online interviews. This facilitates communication and creates trust.
As with traditional on-site audits, a clearly defined PBC list – a list of documents that must be provided by the entity being audited – should be drawn up and communicated well in advance. A preliminary critical review of the documents received is advisable to gain an initial overview and, if necessary, to request missing documents.
Since, given the current situation, many employees are also working from home, this gives rise to additional security and data protection risks. Here, care must be taken on both sides to ensure compliance with approval processes.
Finally, remote audits should include conducting a qualitative assurance assessment on a regular basis. An assurance assessment is designed to ensure that an audit has been performed correctly and produces meaningful results. The subject, objective and circumstances of the audit need to be taken into account. The objective is to identify and assess the risk of reduced assurance or the limits of the meaningfulness of a remote audit. The next steps of the respective audit can be planned on this basis.
Conclusion
In summary, remote audits can generate significant cost benefits and efficiency gains overall if both parties can work on a basis of trust and conscientious preparations are made in advance. The remote audit will continue to prove itself as a suitable and flexible tool even after the times of coronavirus. A hybrid form could also establish itself going forward where, for example, the initial audit is conducted on site and subsequent audits are performed remotely.
Source
Eulerich, Marc & Wagener, Martin & Wood, David. (2021). Evidence on Internal Audit Effectiveness from Transitioning to Remote Audits because of COVID-19. - Evidence on Internal Audit Effectiveness from Transitioning to Remote Audits because of COVID-19 (researchgate.net)