Remote Internal Audit in the Covid-19 Era - Key Considerations
“With the Covid-19 era re-defining the new norm, businesses across the globe are scrambling to cope with the situation. It’s time for Chartered Accountants engaged in the Compliance function to step into the new era and start the process of conducting Remote Internal Audits. In this article, we analyse how the characteristics of Remote Internal Audit, the challenges/opportunities and key considerations to ensure that the objectives of Internal Audit are met in a similar fashion and there is no compromise on quality. Read on to know more…”
With the Covid-19 era re-defining the new norm, businesses across the globe are scrambling to cope with the situation. It’s time for Chartered Accountants engaged in the Compliance function to step into the new era and start the process of conducting Remote Internal Audits.
One of the pre-requisites of a career in Internal Audit is the willingness of the incumbent to travel extensively. However, it will take some time before the Internal Auditor can travel freely to the manufacturing plants, ports, sales depots and warehouses to conduct the Internal Audit assignments. For now, the audits will have to be done remotely without any site visit.
In essence, whether it is site-based or conducted remotely, the purpose of Internal Audit remains the same. Standard on Internal Audit (SIA) 230 - Objectives of Internal Audit- read in conjunction with the “Preface to the Standards on Internal Audit,” “Framework Governing Internal Audits” and “Basic Principles of Internal Audit” issued by the Institute of Chartered Accountants of India governs this theme.
“Internal audit provides independent assurance on the effectiveness of internal controls and risk management processes to enhance governance and achieve organisational objectives.”
Characteristics of Remote Internal Audit
Here, interviews are conducted with the auditee, say using Microsoft Teams, Google Hangouts or any other mode teleconferencing. The auditor reviews the documents and data through screen or file sharing and discussions are held with fellow team members. The auditor selects data points for through Sampling Techniques Records and using a risk-based approach. The auditor is given a walk-through of the processes using technology. In Remote Audit, you may need to bring in aspects of Desktop Auditing (i.e., analyse documents or data in isolation so that you can prepare for / refine interviews and record requests).
The key considerations that will emerge are as follows:
a) Usage of Technology
- Technology can be leveraged to ensure access to site data through applicable ERP packages such as SAP, Oracle etc. Manual registers could be scanned and copies made available to the Internal Auditor through Google drive etc.
- While the internal auditor continues to remain off-site, through Video Conferencing mode, he/she can witness activities such as Physical Verification of Assets and Stock being conducted by the site-personnel.
- Cloud based technologies can facilitate the collaborative team effort.
- While using technology is great, however, there is an increased risk-inbuilt of hackers taking advantage of the situation and gaining access to systems and documentation.
b) Audit Planning
Perhaps, this is the most important consideration which the Team Leader needs to envisage. In view of the changed scenario of businesses, the priorities and business procedure also have changed, which have in-turn affected the risks and control system of the organisation.
- Since the future is unknown, Instead of building a regular long-term Annual Audit plan, short term assignments may be mandated (“Agile Audit Plan”)
- The concept of scheduled dedicated days of Audit at site to be converted into a defined work-schedule
- Working as a business “facilitator” while maintaining its independence viz. Engaging with other stakeholders such as Statutory Audit so that unnecessary duplication may be avoided
- Providing real-time important updates to management on immediate emerging risks
If I am accessing the data through screen sharing, how will the electronic documentation happen?
Whereas Standards on Auditing traditionally address as to “What” evidence is required, in the current times, Auditors need to step-up and formulate as to “How” the documentation will take place whilst being fully compliant with the regulatory requirements.
- The IA personnel can request for a “time-stamped” video or photo, which can be considered an alternative procedure and documentation for Stock taking in the current scenario.
- In case of accessing any off-ERP report or MIS, a signed PDF may be considered sufficient audit documentation.
It is to be stressed upon again that just like documenting any verbal communication, documentation of electronic communication is of prime importance.
c) Audit Effectiveness
One needs to evaluate whether the objectiveness of the audit can be achieved in the remote mode. For instance, it could be easier for the auditee to keep burning issues under the wraps in the remote mode.
This can be an ideal time to completely reassess the defined internal controls over different areas of the business organisation in view of the changed scenario.
- Short and focussed studies may be carried out in presumed risk areas
- Identifying areas such as Force Majeure, Liquidated damages, Cyber Security, Business Continuity/ Loss of Income Insurance and its claim
- Focus may also be given on areas such as changes in supply chain and its consequent changes in cost, losses of customers, credit terms with both vendors and customers
- Long pending issues which are no longer relevant in current scenario may be discussed and concluded
- In these times of pandemic wherein the organisations may be working with sub-optimum work-force, there may be instances of control over-ride and also create opportunities of fraud
- Effectiveness of Audit can be increased by using analytical tools so that coverage of high risk areas can be increased to close to 100% assurance
d) Cost
Internal Audit in the remote mode will always be more cost effective. Since there will not be any site visit for some time-period. The current year Internal Audit budget may be utilised for:
- Further strengthening the IT infrastructure and analytical tools used by IA personnel
- Team members may be encouraged to undertake relevant and emerging online courses
- In case it is required, a local expert may be engaged for site visit, keeping in mind the risk and cost benefit.
e) People Factor
It is common knowledge that informal discussions over cups of tea/coffee often lead to camaraderie between the auditor and auditee. The auditor gets a more accurate understanding of the ground realities. The auditee gets the comfort of resolving a lot of audit observations through face-to-face discussion. Non-verbal communication plays a major role here.
There are more chances of discovering fraud or catching hold of malafide intentions in case of onsite Audit. Attitude and behaviour of the Auditee plays a big role in assessing the culture and on goings at the Audit location.
In remote audits, the latter can feel a bit intimidated because everything is a bit more formal. Another school of thought envisages that remote Audit might create new opportunities, since test-procedures can be conducted without any direct involvement of the Auditee, innovative and unexpected procedures can be used to eliminate any fraud risk areas, thereby enhancing the quality of Audit.
Even in case of remote Audit, Video-conferencing can be used intelligently to catch the non-verbal cues. Seeing the “Face” makes such lot of difference.
Reception of the Auditee/Client in these times can also be taken as an important cue, while some may be facing real hard-ship in routine jobs, continuous avoidance or indefinite postponement taking Covid-19 as an excuse can be a red flag.
f) Engagement with team members
A brief distinction between On-site and Remote Audit can be summarized as under:
| Area | On Site | Remote | Considerations |
|---|---|---|---|
| Pre-Audit | Senior member/Team Lead in the IA team interacts with functional and location heads | Interaction is held online through video-conferencing call | Face-to-Face meeting is held to get an initial brief and understanding. Virtual meeting seems to be more formal |
| Interviews | Interviews are held in person with the specified personnel | Interviews are held over call/VC or through online forms | Lack of non-verbal cues |
| Review | Physical inspection/walk-through and review of documentation | Data from ERP/in-house software are reviewed | Dependence on system data |
| Risk profile | Risk is assessed as per interaction and interview with the functional managers | Focused areas are selected and risk assessed based on continuous online monitoring | Major changes in risk profile |
| Evidence Collection | Mostly stored in Hard-Copy files | Mostly soft-copy, pictorial or video evidence stored on cloud/online | Online evidences can be used remotely by anyone of the team-member |
The senior members from Internal Audit team can virtually try and keep the team motivated and connected in the current times:
- Primarily checking upon the health of the team members who might be away from their regular base locations.
- A dedicated session may be kept wherein any emerging issue in the business world or any new challenge may be shared upon by any team member
- Virtual Coffee/Tea breaks- with change of hosts
- De-briefing session- A short daily de-briefing session may be held at day end wherein achievements during the day may be appreciated and also challenge for days ahead may be set.
Remote Audit: Advantages and Limitations
The following is a summary of advantages and limitations that a company may have if it implements remote audits.
Advantages of Remote Audit
- Given the Covid circumstances, normalcy is not expected to return in near future. So, implementing remote audit would give organisations a sense of normalcy in day to day operations.
- Reduced travel costs. Organisations having multiple annual audits would have significant savings in terms of travel costs, if remote audits are implemented.
- Since audits would be done remotely, there would indeed be an expanded pool of available auditors rather than just the ones who could travel to the specified location.Also, this would mean we would have more time and thus, areas covered can be expanded.
- Specialists could be brought in significant areas in case required without worrying about the fact that they need to be present for full audit.
- Since the documents would be at the disposal of the auditor for a larger time frame, he could easily dig down to details and have a higher quality review.
- Improved use of available technology strengthens documentation and reporting. Facility personnel’s use of technology to capture video and photographic information contributes to improving their understanding and use of available technology. This contributes to better documentation of facility conditions, improved ability to report incidents and conditions to remote corporate personnel, and increased opportunities for future remote training tools.
- The audit burden to facility operations is mitigated. This is one of the biggest advantage of remote audit. Audit documents and videos can be gathered and digitized at regular intervals and need not be restricted to the audit period when the auditors visit the organisation. Daily activities of the facility personnel thus don’t get disrupted.
Limitations of Remote Audit
As they said first hand observations are always better than just relying on documents. Documents can be misleading sometimes where operations are secure, highly restricted, or in sensitive environments.
Opportunities to provide hints, tips, and observations for improvement are lost. It is hard to identify best practices or describe things that others may benefit from, outside of the documentation process. Good auditors do this, and these are often the most useful things that auditees get from the exercise.
The opportunity to present doctored documents and to omit relevant information is increased. This may call for additional planning, some additional/different audit procedures, or a follow-up once the barriers to a traditional audit lift.
Conclusion
Remote auditing isn’t going to go away it will become the new normal and hence it’s imperative that we gear up to the changed scenario. If internal auditors provide critical guidance now, while also prepare for the future. Internal Audit function will emerge as a stronger team which provides even greater value to the department and the business.
Who knows that some of the work which have been successfully tested and delivered while working virtually might be mandated to be done on “off-site” basis, as it will save both time and resources of the organisation without any compromise on the assurance levels or regulatory norms. This will also potentially open much greater participation from the female workforce who could have had issues with the logistics of long travels to remote locations. In all, it will also ensure greater work-life balance for the audit community as a whole.
Challenge for the Internal Audit fraternity also lies in the fact that increased virtual engagement and availability of enhanced analytical tools might call for a reduction in Audit personnel and as such they need to be more abreast with emerging tools and skilled up so that an individual’s relevance and contribution in the team can be counted upon. Thereby the onus would be upon the internal Audit function owners to demonstrate that they can engage teams irrespective of location. Chances are fairly bright they can create an immersive audit experience that comes with similar trusted skillset!
Whether conducted on-site or remotely, the core objective under SIA 230 remains intact: providing robust independent assurance and strategic foresight to strengthen organisational governance.