Author:
Mehmet Kamil Tarhan
There has been a search for several years for remote audit approaches, including the use of technology, that would bring a new dimension to internal audit. In the company surveys conducted in the last two years, it was learned that some companies went beyond the testing phase in this regard.
The emergence of COVID-19 and associated worldwide travel restrictions, combined with the need to conduct inspections based on existing regulatory, legal, or urgent needs, has led to a focus on efforts to find alternatives to the traditional on-site inspection now implemented.
Our article, benefiting from the experiences of some organizations using remote internal auditing abroad, together with the advantages and disadvantages of remote internal auditing, aims to assist in how the planning, opening, and closing meetings, interviews, document review, and field studies that need to be done during the audit process can be carried out.
Remote Internal Audit Components
The components of a remote internal audit are similar to on-site internal auditing in many ways. However, the focus, responsibilities, and execution of these audit stages are different.
1.1. Task Planning
In Internal Audit, task planning is critical, including purpose, scope, timing, and resource allocation. According to international internal audit standards (UIDS)
“Internal auditors must prepare and write down a separate plan for each assignment, taking into account its objectives, scope, timing, and resource allocation. The plan should take into account the Agency’s strategies, objectives, and mission-related risks. (UIDS 2200-Mission Planning)”
In remote internal auditing, the planning should also include issues such as which technologies will be used, necessary permissions (Video, photography, etc.), and professional experts to be used in places that cannot be visited.
1.2. Opening (Stakeholder) Meeting
In on-site internal audits, After examining and researching the unit and process to be audited and obtaining the necessary information, an opening meeting is held with the manager of the unit to be audited and other responsible persons (stakeholders). In this meeting, the following issues are specifically discussed;
- Purpose and scope of internal audit,
- Internal audit method,
- How internal audit results will be shared,
- Estimated duration of internal audit,
- Expectations from staff and employees who will assist in internal audit,
- Expectations of the audited unit from internal audit,
- How communication will be carried out between the internal audit team and the audited unit,
- Benefits of internal audit,
- General information about the internal audit process.
In remote control, In addition to the above, The scope of the remote audit approach should also include an outline of expected similarities and differences between on-site audits and remote audits to which stakeholders are accustomed. This may require more time than usual for the opening meeting.
The issues discussed at the meeting are recorded in a minute.
Examples of the types of information that should be covered include how and when information will be shared, what technology will be used (everything from cameras to drones to “telepresence” (video conferencing) support), what authorizations must be obtained in advance to take videos and photographs. We can tell you which hidden or restricted areas should be considered or avoided.
It is also essential to discuss the limitations of the remote audit from the outset and explain that, based on the findings of the remote audit, on-site work may be required in the future once barriers to a physical site visit have been removed or (for example, travel bans have been lifted). Considering the above considerations indicates that internal auditors must allocate approximately twice as much time for a remote audit planning meeting compared to what is required for a traditional audit. Video teleconferencing, as well as the use of PowerPoint or other visual guides, are also helpful for this meeting.
1.3. Document (Written Information and Document Review)
Remote document reviews are, in many ways, similar to reviewing documents on the audited unit, with a few major caveats. However, it takes more time for the audited unit to prepare the requested documents and upload them to a file-sharing platform (SharePoint, “shared drives,” etc.) than accessing the files on-site directly or through employees.
Depending on the documentation method (paper records, database storage system, etc.), audited unit personnel should take the time to convert these records into a reviewable format (such as PDF) and upload the files. Auditors should obtain and review information in the most readily available format to minimize the burden on employees of the audited unit.
Direct access to the digital file system used by the audited unit should be granted for the duration of the audit.
Consideration should be given to developing effective strategies for reviewing data remotely. If necessary, help should be sought from the employees of the audited unit in this regard. For example, sampling may be the best option depending on the number of records to be examined.
Unlike on-site record reviews, remote reviews generally do not allow concurrent questions. When reviewing records remotely, the auditor should write down questions and ask them during remote interviews.
However, one way to incorporate simultaneous questioning during remote inspections is to create a video teleconference between the auditor and the process officer being reviewed. This allows documents to be shared and reviewed and questions and answers provided in real-time.
1.4. Site Discovery
In internal audit, stock areas, production activities, layouts, etc. Examining the process in person is very useful for a better understanding of the process. However, remote site discovery is the most challenging aspect of remote auditing. Some companies from whom information was received on this subject stated that they tried various technology solutions to perform an adequate location discovery.
One approach is to use live, two-way communication technology such as two-way smart glasses and live streaming sites.
Akıllı gözlükler sadece lenslerden daha fazlasıdır. Bilgileri işleyen ve sonuçları yalnızca kullanıcının görebileceği şekilde gerçek zamanlı olarak gösteren küçük bilgisayarları vardır. Bu, gelen bir çağrı hakkındaki bilgileri, bir hedefe ulaşmak için bir GPS rotasını ve hatta işitme engellilere yardımcı olacak altyazıları içerebilir.
AR gözlükleri olarak adlandırılan akıllı gözlükleri veya artırılmış gerçeklik gözlüklerini de görebilirsiniz. Karma gerçeklik de benzer bir terimdir. Bilgisayar işleme yetenekleri nedeniyle, bu gözlükler akıllı telefonların eşleşemeyeceği sorunsuz bir şekilde entegre edilmiş bir şekilde bilgi sağlayabilir ve günlük yaşamı iyileştirebilir.
Although the idea of live broadcasting seemed attractive and necessary, some obstacles were encountered.
Many of the organization facilities audited needed facility-wide Wi-Fi. Even at facilities that claimed to have facility-wide Wi-Fi, it did not cover remote areas of the site (such as storage tanks, docks, large warehouses, and storage areas).
The quality of live video streaming could have been better in some indoor locations and areas with weak signal strength.
Since the video broadcast was concentrated at specific points and environmental observations were impossible, observation at the desired width was impossible.
Ambient noise or, conversely, the noise-canceling features of technology made it difficult to understand conversations.
An alternative to live, two-way communication has been video and photos taken using company cell phones. The advantage of this approach is that these devices are readily available and are compatible with most enterprise computer storage solutions (e.g., SharePoint). Moreover, the signal strength at the collection point does not negatively affect such devices’ video and photo quality.
As noted in the planning section above, using digital devices often requires pre-planning and special permissions.
During the document review, auditors should compile a list of essential and auditable areas they want to capture with video and photographs
1.5. Sharing Findings through Remote Meetings
After inspection field tests, The findings should be shared with the managers and process managers after they have been previously informed via electronic communication. This is achieved through remote meetings.
Remote interviews are conducted in the same way as an in-person interview and can be accomplished by scheduling video calls with key individuals using any number of off-the-shelf technologies (e.g., Microsoft Teams, Skype, and Zoom).
30-90 minute meetings should be planned with unit managers. Shorter, 15-minute interviews may be held with designated personnel with process responsibilities.
Video calls are preferred over audio-only calls because non-verbal communication (*) is integral to interpersonal communication and can be lost without video.
(*) Non-verbal communication includes forms of communication expressed through gestures, facial expressions, or other non-linguistic signs other than spoken language. A significant part of daily communication is based on nonverbal communication. (Wikipedia)
If more than one auditor participates in an interview, care should be taken to ensure that the interviewer or other auditors speak at different times. It should be noted that an auditor, like many people who do not do a job regularly, may not be comfortable video chatting with a subject matter expert, such as a talented sales and marketing executive.
1.6. Closing meeting
The closing meeting is held after the findings and recommendations are shared to ensure that both parties fully understand each other regarding the audited unit and the issues included in the findings. The purpose of this meeting is not to convince the audited unit of the issues included in the findings. Even if there is a difference of opinion, it is crucial to fully understand what disagreements exist on which issues. The Internal Audit Unit Manager may attend closing meetings if deemed necessary.
A report should be prepared after the meeting at the closing meeting, discussing the audit findings, recommendations, the significance level of the findings, the actions to be taken, and the implementation schedule.
The closing meeting for a remote audit is almost the same as the closing meeting for an on-site audit.
It is recommended that the closing meeting be scheduled a few days after the remote interviews. This creates an opportunity for the audit team members to review their own notes and findings and compile a preliminary draft report.
The audit closing meeting is an opportunity to present these preliminary draft audit results to the stakeholder audience, resolve any questions or concerns, and discuss the results toward finalization and continuous improvement.
Advantages and Disadvantages of Remote Internal Audits
By benefiting from the experiences of some companies that use this form of auditing, we can summarize the advantages and disadvantages of remote auditing as follows.
2.1. Advantages
- Restoration. The restoration of a much-needed sense of normalcy.
- Reduced travel costs. Remote audits can provide significant savings for an audit program with multiple annual audits.
- Expanded auditor pool. A retiree in Istanbul, a part-time auditor in Ankara, or even an auditor abroad can join the audit team.
- Extended coverage. Remote audits provide excellent coverage when transaction volume and time constraints are competing.
- Wide use by experts. Experts can connect remotely for selected interviews or portions of audit planning; they do not need to be present in person.
- Improved document reviews. Remote review of plans and documents at auditors’ own pace contributes to a higher quality review and deeper penetration of documents.
- Technological development. Better use of existing technology strengthens documentation and reporting. Audit staff’s use of technology to capture video and photographic information contributes to improving their understanding and use of available technology. This contributes to better documentation of process conditions, the ability to report events and conditions to remote company personnel, and increased opportunities for future distance learning tools.
- Reduced audit burden. The audit burden on the audited unit is lightened. The time required to collect and digitize documents, videos, and images can be spread over several weeks rather than concentrating on one audit period that takes staff away from their daily activities.
- Improved organization and confirmation of required documents. Since the staff of the audited unit must review and assemble the necessary documents, the remote audit provides an opportunity to organize and approve all documents necessary for a detailed review.
2.2. Disadvantages
Below are some limitations of the remote audit approach.
- Direct observation holds a distinct significance. There is nothing like seeing processes firsthand, observing body language, or even noticing a smell that shouldn’t be there in remote monitoring. Online auditing is subject to certain security limitations. Sometimes, it may only be possible to use a video device in some processes and departments of the business.
- Remote supervision makes establishing relationships with supervisees difficult. Opportunities to provide tips and observations for improvement need to be recovered. Outside of the documentation process, it is difficult to determine best practices or define things that others can benefit from. These are helpful topics that experienced auditors acquire during field audits.
- Lack of personal interaction can lead to fraud and abuse, such as submitting an irrelevant or incorrect document. It may require some additional different audit procedures or follow-up.
- Technology glitches may occur, such as needing help to establish a conference bridge with some relevant people and people needing help to turn on their microphones and hear. Some corporate firewalls have size limits for video and photo files and may require audited unit personnel to obtain Information Technology assistance when uploading them.
However, all these obstacles can be overcome with time and experience.
Roles And Responsibilities Of The Internal Audit Manager In Remote Audit
International internal audit standards, within the scope of increasing the contribution of internal audit to the institution, have placed a particular emphasis on the management of the internal audit activity and have determined separate standards specific to internal audit managers.
The Internal Audit Unit Manager is responsible for the management of the internal audit activity. The Internal Audit Unit Manager is responsible for managing the internal audit activity in a way that adds value to the institution’s activities and ensuring the highest level of compliance with the UIDS while performing this duty. (IIA- UIDS 2000-Management of Internal Audit Activity)
The Internal Audit Unit Manager may determine policies and procedures on matters deemed necessary for the internal audit activity to more effectively fulfill its function of adding value to the institution and increasing compliance with IDS, provided that it is not contrary to the internal audit legislation. (IIA UIDS 2040-Policies and Procedures) It becomes essential to make new additions to the policies and procedures to be determined in an environment where COVID-19 affects every business and person, regardless of country, geography, or sector.
What can be done in this regard is listed below:
Maintaining open and consistent communication with inspection teams and reminding them of the precautions needed to protect themselves and their families is essential.
Due to events arising from COVID-19, audit plans and current ongoing work should be reviewed. Future audits should be prioritized according to their importance, legal obligations, how applicable they are in a potentially complex and challenging environment, and how audits can be carried out without physically accessing corporate locations. It should be taken into consideration that it will be completed.
Remote staff must have their perspective recalibrated to reconnect them with your purpose. It creates a different feeling when a team cannot work together side by side. If it has been decided that team members in specific locations should work from home, these team members should be supported with the necessary technological resources and some guiding principles on how to behave in these extraordinary times.
A strategy should be developed to use the team’s time best. Suspension of activities will also affect internal audit. In this way, there can be a significant increase in the capacities of team members. This process can create new opportunities for internal auditors to complete the work they have yet to finish and to improve themselves in professional knowledge, internal controls, and risk management assessments.
Video, photo shooting, teleconference, etc. Consider how remote audit technologies can improve how internal audit functions deliver value.
Consideration should be given to how data analysis can be performed using centralized source systems to perform internal audits without needing a traditional site visit.
Consideration should be given to replacing face-to-face meetings with technology applications such as video conferencing to reduce the time spent reading and responding to emails.
The internal audit plan should be reviewed, and the internal audit approach should be re-evaluated. In cases where an internal audit team cannot physically visit a site, the issue of whether the physical controls in the production facilities are working or not can be checked with video footage should be investigated for risk assessment.
Especially in organizations operating in more than one country and location, professional teams that can carry out on-site inspections in the relevant geography can be used so that there is no need for central inspection teams to travel. For example, a topographer from the region can be used in censuses.
Conclusion
Innovation and transformation are the focus of businesses and audit programs around the world today. Remote control is also such a thing. Several emerging technologies show great promise in this area, including live video streaming, augmented and virtual reality, unmanned aircraft (“drones”), and artificial intelligence.
However, the appeal of new technology should allow us to use existing ones. Unmanned aerial vehicles require an experienced and licensed operator. Live streaming and augmented reality require specialized equipment and high bandwidth. Instead, smartphones and video sharing can also be used as remote control tools.
Remote control is not a one-size-fits-all solution. It does not replace on-site control. However, as part of an ongoing assurance program over the years, epidemics, travel restrictions, and terrorism may provide alternative assurance when it is necessary to apply due to particular circumstances.
References
- Remote audıtıng for covıd-19 and beyond, Roy Litzenberg, CPEA ve Carrie F. Ramirez, CIA, CHMM, CDGP
- Teolupus İç Denetim ve Risk Yönetim Danışmanlığı, İç Denetim Rehberi
- II A Uluslararası iç denetim standartları
- KPMG Nisan 2020 COVİD 19 ve İç denetim Liderlerinin Rolü
Bu gönderi şu adreste de mevcuttur: Türkçe
