In current circumstances one frequent question we are receiving is with regard to the effectiveness of remote auditing. Certification bodies without exception are continuing to complete their planned audits and are doing so in most circumstances with the aid of technology. Can they really be sure they have covered everything and can the results of a remote or desktop audit be comparable to the more traditional face-to-face approach?
The simple answer here is yes, they are effective and yes, it is possible to cover the scope of planned audits (with some exceptions).
The following describes what needs to be done to make the audit a success. And by success we mean that the auditor collects suitable and sufficient objective evidence to allow it to be measured against audit criteria in an effective way.
The secret to any audit, and in particular remote audits, is in the planning phase.
When we at QCS International teach auditing, we spend a considerable amount of time emphasising the importance of planning in advance. In fact, in some cases an auditor might invest as much time planning for an audit as actually collecting the evidence. The key things to consider in the remote audit in particular include:
- Communications. It is not enough simply for the auditor to send the auditee an agenda. It is advantageous to provide more detail on what is to be covered, suggesting documents that may be made available in advance and to ensure the host is also prepared with the information the auditors requires.
- Following on from communications is an advance test of the communications infrastructure. Whilst we are becoming more familiar with Teams, Zoom and Skype, it is beneficial for both parties to have a test run if possible – checking bandwidth, software compatibility and audio channels. Get these ironed out in advance so as not to interfere with audit time.
- The auditor will have to carefully consider their checklist – perhaps amending some checkpoints or thinking about new ways of asking to see relevant evidence. Rather than ask for items of documentation on the day of the audit, ask that these are sent in advance, which may then lead to follow-on questions during the live session instead of time reading.
- It may also be necessary to think about to whom you ask the question. Availability of staff during lockdown may be limited and some activities may not be in operation – meaning that there is the possibility of some of the audit scope not being covered. If this is the case consider if there is other areas you could usefully use your time to be incorporated in to the audit. Change your schedules so that things you cannot observe will be incorporated into a future event.
All of the above are things to consider as part of your planning, but there are changes in the way the audit itself will be completed. Critical will be establishing the scope of any remote audit. It will be simple to review management system arrangements but less so when reviewing operational controls
The auditor might have to think about the following:
- Appreciate that some of your usual questions or approaches may not be as effective in the remote audit scenario. It is not as easy to build up a rapport with your auditee when speaking via a video conference so make extra efforts to be accommodating, to clarify your questions and to listen for longer (pauses are absolutely fine to ensure everyone does not talk over one another).
- Observation is certainly part of many audits – what the auditor sees is a key part of objective evidence. If you need to see something, then perhaps arrange for this in advance (see above) and be creative in using the IT. Few people today do not have a smart phone with the ability to video conference. See if mobile phone elements of the audit are possible (with the caveat that it does not infringe any security or privacy rules).
- Sampling should be random and controlled by the auditor and not the auditee. This is not as easy in a remote situation as the auditee is in a position to ‘feed’ information to the auditor. Take care to make attempts to gain evidence that is truly reflective of the situation – ask for documents from which you can request specific items on the day and be careful not to allow the auditee to have everything lined up in advance!
For the auditee, the need to prepare is equally important and will rely upon the communications from the auditor in advance to a high degree. The auditee should also be prepared with documentation and other evidence as required. Other things for the auditee to think about include:
- Setting up the location in which you will host the audit. Ensure it is in a quiet room with a good internet connection and that you will not be interrupted. This is even more important should you be hosting this whilst working at home!
- Speak with colleagues that may be required to join in with part of the audit – ensure they too have suitable connections to the meeting
- Think about where files and records are stored and retained – how easy or difficult will it be to share – are there security or privacy barriers and how will you ensure that documents are made visible to the auditor
Finally, with the current experiences we are gaining with regard to remote auditing there is a possibility that they will continue to be an option in the long term. If so, then there may be benefits as well as drawbacks.
- No travelling or associated environmental impact – if the audit is effective remotely then why invest the time and cost in travel and accommodation
- More efficient use of time – no time lost in travel and greater likelihood of work being completed in an office environment
- Audit programmes stay on schedule during times when it is not possible to do face-to-face audits. To retain certification every effort must be made to maintain internal audit programmes as well as certification body audits.
- Recognising the results – there continues to be scepticism amongst some on the suitability of remote audits. In many cases there will continue to be a need to be on site – but with careful planning most remote audits can be equally robust as those face-to-face
- Technology – issues with technology not working or being available. This should improve with experience
- Lack of familiarity or training – auditors and auditees need to become more familiar with the technique. Note that ISO 19011 includes reference to remote audits and all certification bodies and the IAF will recognise the results of remote audits for certification purposes.
Should you have any concerns about your internal audits and hosting certification body visits at this time then do get in touch with us at QCS International on Tel: 01236-734447 or firstname.lastname@example.org. We wish everyone well during this time.