Remote Audit Work: Best Practices

The Rise of Remote Auditing

Remote auditing has become a standard practice in the IS audit profession. Whether driven by geographic distribution of operations, cost considerations, or global events, auditors increasingly conduct significant portions of their work without being physically present at the auditee's location. Successful remote auditing requires adapted techniques and deliberate attention to communication and evidence quality.

Planning for Remote Audits

Effective remote audits require enhanced planning:

• Technology Assessment: Verify that both the audit team and the auditee have the necessary technology for remote collaboration, including video conferencing, screen sharing, secure file sharing, and remote access to systems.
• Communication Plan: Establish clear communication protocols, including primary and backup channels, meeting schedules, and escalation procedures.
• Evidence Strategy: Determine in advance how evidence will be collected and transmitted securely. Define acceptable formats and transmission methods for different types of evidence.
• Scheduling Considerations: Account for time zone differences when working with geographically distributed teams. Schedule critical interviews during overlapping business hours.

Conducting Remote Fieldwork

Remote Interviews

• Use Video: Video calls are more effective than voice-only calls because visual cues help build rapport and assess responses.
• Record With Permission: With appropriate approvals, recording interviews allows for more accurate documentation and review.
• Share Screens: Ask auditees to share their screens when demonstrating processes or system configurations. This provides visual evidence comparable to in-person observation.

Evidence Collection

• Secure Transmission: Use encrypted file sharing platforms for transmitting sensitive audit evidence. Never use personal email or unsecured transfer methods.
• System Walkthroughs: Request live demonstrations of system processes via screen sharing rather than relying solely on screenshots, which can be selectively captured.
• Automated Evidence: Leverage automated tools to extract evidence directly from systems, reducing reliance on auditee-provided evidence.
• Documentation Standards: Maintain the same documentation standards as in-person audits. Document who provided evidence, when it was received, and how it was transmitted.

Overcoming Remote Audit Challenges

• Building Trust: Without face-to-face interaction, building rapport with auditees takes more effort. Schedule informal check-ins and be responsive to questions and concerns.
• Verifying Evidence: Remote evidence may require additional verification steps. Consider requesting multiple forms of evidence to corroborate findings.
• Observation Limitations: Some audit procedures, such as physical security reviews and environmental controls assessments, may require periodic on-site visits even in primarily remote audits.
• Team Collaboration: Keep the audit team connected through daily check-ins, shared workspaces, and regular progress reviews to maintain cohesion and quality.

Security Considerations

Remote auditing introduces security risks that must be managed:

• Use VPN connections when accessing client systems remotely.
• Ensure audit workstations meet security standards for handling sensitive data.
• Follow data handling policies for storing and transmitting audit evidence.
• Verify the identity of remote participants before sharing sensitive information.