The new world of remote auditing

By JJ Edmunds, CPA, and Genevieve Hancock, CPA

While the destination for auditing has not deviated, the path on how we get there has changed due to COVID-19. With offices closed everywhere, and especially closed to outside auditors, the ability to perform audits from a remote location has become a necessity.

Historically, being on site at a client is a staple in the world of auditing, assurance and public accounting. Face-to-face meetings have now been replaced by viewing someone through your computer screen. The traditional suit-and-tie has become the “new” business casual of flip flops, gym shorts and a collared shirt.

The same concepts ring true for internal audit. Where once the internal audit or operational audit teams may have had to balance being on site and remote for testing, suddenly our new reality has made entirely remote audits a necessity through video meetings and support acquired remotely.

Public accounting and assurance services

For external assurance services, one of the biggest keys to success for completing an audit remotely is proper planning. Planning is always something that can be constantly overlooked, as auditors are ready to just get fieldwork started. A planning meeting should be set up with both the audit team and the client to ensure everyone is on the same page about the audit plan.

One of the first things to tackle is the similarities and differences between a normal on-site audit and a remote audit. How the schedule will be impacted is now a major consideration since auditors can no longer just walk down to client’s offices; it is important to pre-arrange meeting times to ensure everyone’s availability. By putting in a little more work to the planning process, the result will enable fieldwork to run smoother and more efficiently.

After scheduling has been nailed down, it is important to re-examine risk. Brainstorm all the ways COVID-19 could impact or change the audit to determine what controls have changed and which line items may potentially bear higher risk. It is not always a given that controls have deteriorated due to COVID-19. It is important to re-assess risk in order to be as efficient as possible with your audit procedures.

You should also address how testing will be performed and identify any limitations. Gone are the days of watching over someone’s shoulder as they generate a report or pull items from a file cabinet. Work with the client on a case-by-case basis to collaborate and get testing support in the best way possible. Flexibility is key, as testing support may be in a different format than it has historically. Be creative when it comes to testing. Really think about the purpose of the test and what you are aiming to accomplish. So often we fall into the trap of just doing testing because we did it in the prior year.

The ability to obtain testing support in electronic formats is also extremely helpful for auditors. That can allow them to move at their own pace and review supporting documentation more in-depth than they might have only viewing paper support collaboratively with a client at an office. However, data security is an increased risk with electronic support. Consider using a secure file transfer site to allow easy transfer from clients to auditors without the risk of data being compromised. Clients could also use a cloud-based software that allows auditors to log in to the network without being on site. As long as auditors have read-only access, an auditor’s independence will not be compromised and the risk of auditors altering data is minimized.

One of the biggest hurdles to remote auditing is inventory/physical asset observation. However, this can be done through video recordings or live streaming. It may be more challenging, but it is possible.

Not only has the way we communicate changed due to COVID-19, but also the frequency of communication is another area that has been significantly affected. It may be helpful to conduct daily meetings to discuss the plan for the day and what was accomplished the previous day. Since auditors are no longer all together in an audit room, communication can easily deteriorate. Communicate with a purpose in order to stay on track for timing and ensure there are no doubled efforts or wasted time.

Internal audit

Internal audits should add value to an organization and improve operations, so they, too, must evolve in a remote world to continue providing that value. Many of the key changes in internal audit mirror those for external audit. The idiom ‘an ounce of prevention is worth a pound of cure’ applies to putting extra time and effort into planning and status meetings for timing with the audit team performing the testing of controls or operations and the documentation of those controls. With an internal audit, this may also cross over more often into status and planning meetings with additional key stakeholders internal to the company, whether that includes the finance, FP&A, compliance and accounting departments, and relevant consultants. Ensure that conversations are happening in advance to understand transaction cycles and processes, and especially concentrate on any variances around the company — if something is out of the ordinary at a certain location or transaction stream, ensure that is documented. Having the understanding and the conversations prior to  beginning testing can prevent complications or having to retest later.

Interim testing and support will depend on the company’s structure and fiscal year-end date. Obtaining testing and support for the first part of the year, when the workload is not particularly heavy, may help lighten the workload for the third and fourth quarters or potential retesting later on.

To complete remote internal audits and ensure communication and deliverables stay on track, it is crucial to find or develop user-friendly, eye-catching tools and tracking sheets that are easy to review and navigate. Many emails (especially long and tedious ones) tend to be skimmed and overlooked in this ‘email-overload’ era, and you won’t always have the ability to walk over to an office and strike up a conversation. Status meetings with key stakeholders at the site in video chat are now imperative. Ensure you start with specific goals when meeting with those outside the audit team, and close with the takeaways and a summary or updated tracking sheet on the next steps to save a lot of pain later on.

Revisiting the risk assessments performed, or at least documenting that the team has reevaluated the risk at a disaggregated level, is also a key component in the changing remote internal audit world. Changes to the business model caused by the abrupt shift in how we work on a global level can impact the risk associated with certain processes. For example, short-term delays or changes to delivery or supply chain management, payroll or benefit changes due to decreased employment capacity, or unexpected changes to long-term costs that are being reassessed (like leases or debt arrangements) may all be out-of-the-ordinary transactions that require identification and additional testing of affected controls. Certain controls that were normally mitigating risk may have been overlooked in an attempt for business continuity; you must identify and document any shifts that may have occurred, even temporarily. Businesses are dealing with a perfect storm of changes, risks, workforce disruptions, business interruptions, and rapid-change management responses — and these need to be subsequently or simultaneously taken into account by auditors once they occur. Make sure to keep medium- and long-term goals for the audit in mind while adjusting for controls and reassessing risk factors.

Caring for your people is always an important factor in a business environment. Make sure to touch base on a human level, not only with business status reports. We are all experiencing the stress that comes from any business model — working remotely with isolation and changes to work and communication processes, or working in the office and experiencing anxiety in the current environment and having to potentially be around other individuals. Touch base, have virtual happy hours, and make sure that one-on-ones are supporting your teams and ensuring everyone has what they need to succeed in this rapidly evolving environment. Accountants, and auditors in general, are well-positioned to have the skills and tools at the ready in order to shift to working remotely.

Conclusion

Now more than ever, it is important to coordinate all the auditor’s resources. Collaborate with internal/external auditors and other outside parties to see what coordination and reliance can be placed on other’s work. Remember: Remote auditing is an evolving process, and it is important to try to be flexible and creative in order to find the best way forward. The COVID-19 pandemic is likely not going away anytime soon, and now that businesses are seeing that audits can be performed remotely and also decrease the cost of travel, internal and external auditors need to begin to accept remote auditing as potentially the new normal.

JJ Edmunds, CPA, CIA, CISA, MSA, is an audit and assurance manager with PBMares, LLP, in Richmond, serving primarily financial institution clients. He is currently chair of the VSCPA Young Professionals Advisory Council and was one of the 2019 recipients of the VSCPA Top 5 Under 35 Award. Find him here on LinkedIn.

Genevieve Hancock, CPA, is the director of technical accounting for Brown & Brown Insurance in Daytona Beach, Fla. Genevieve is passionate about developing leadership skills and mentoring accounting students and young professionals and is a member of the VSCPA Disclosures Editorial Task Force and the Young Professionals Advisory Council. Find her here on LinkedIn.