Is remote auditing here to stay?

As mentioned in my previous blog entry, remote auditing has been around for more than a decade. In
fact, it prompted the International Accreditation Forum to publish IAF MD4 in 2008 – a mandatory
document that has been revised since and is now known as IAF Mandatory Document 4: 2018 for the
Use of Information and Communication Technology (ICT) for Auditing/Assessment Purposes.

So, to give a quick answer, remote auditing is here to stay. Technological advancements since 2008
made conducting a credible and valid remote audit even more feasible. The COVID-19 pandemic merely
forced non-believers to embrace this not-so-novel audit method.

It pays to know, however, what causes auditors and auditees to be jittery on conducting remote audits
and should these concerns be enough to prevent consideration of a remote assessment in the next audit
cycle.

1. Lack or inadequate infrastructure

A reliable internet connection with good bandwidth will most likely be a main prerequisite for
conducting a remote audit. Adequate infrastructure and suitable equipment and software are likewise
major requirements. Aside from the use of web conferencing tools, some auditors have also floated the
idea of using drones, virtual reality, and action cameras.

Personally, I like the idea of using technology to improve the credibility of the audit and in many cases,
they are very useful such as in conducting audits in very remote or unsafe places. I believe there are
auditors who are already using drones to collect information from unsafe or inaccessible areas. I think
there will be even more use for drones in the future, maybe even robots equipped with cameras to
perform inspections and observing the audit areas. I am also predicting more motion-sick auditors as a
result.

Two of the main issues in using video cameras and similar technologies are (1) difficulty of identifying if
the images being shown by the auditee are real-time images or videos and (2) whether the auditee is
only showing preselected areas that they want the auditor to see. These are issues that the auditor will
have to consider prior to conducting the remote audit.

2. Competence on use of ICT

Both auditor and auditee will have to be competent on the use of ICT. It is also advisable to have IT
personnel nearby to quickly address issues that may arise during the audit. Right now, there are quite a
number of web conferencing software and equipment. It may take time for some auditors and auditees
to get acquainted with the use of these software and communication devices, but I think this is
something that can be easily hurdled. The COVID-19 pandemic has already forced people to use web
conferencing technologies and ecommerce, so resistance on acquiring new competencies on the use of
ICT will be less.

3. Cybersecurity and data privacy issues

This is a major issue in conducting remote audits. When more people started using web conferencing
technologies during the quarantine period, it has become apparent that hackers could still find a way to
access the supposedly private meetings. Fortunately, cybersecurity experts are quick to act and patch
the gaps in the system. However, given the speed at which hackers could identify and take advantage of
weaknesses in the system, cybersecurity experts will have to be better at improving data security and
protection. Aside from web meetings, information transferred electronically or those residing in the
cloud may also be more vulnerable to attacks. Organizations are constantly improving their
cybersecurity, but for some organizations, even the idea of sharing information online proves to be too
risky and could hinder, if not prevent, the performance of the remote audit. The issue of the auditor or
auditee taking screenshots or recording portions or the entire audit is also something that has to be
discussed and addressed by both parties.

4. Physical clues

Auditors are trained to be observant as well as perceptive which means that they look for physical clues
that could lead them to a line of questioning where there are doubts as to the effective implementation
of the management system. When conducting interviews remotely, much of these clues would be
absent or circumvented. Microphones may be muted, auditees coached by someone behind the
camera, and images and files manipulated. It is the auditor’s responsibility to confirm the veracity of
information through objective evidence, but this becomes even more difficult in a virtual environment.

The audit program manager and audit team will need to conduct an evaluation of the risks on the
integrity of the remote audit. For example, should there be issues (like those mentioned above) that
cannot be resolved, organizations may opt to postpone the audit within six months or until such time
that a physical audit may be safely conducted which may also mean suspension of their certificate. For
initial assessments, audits requiring physical measurements or inspections, as well as for organizations
with complex processes, remote audits may also not be feasible nor advisable.

So, if remote auditing is here to stay, can it totally replace physical audits? In principle, yes, it can, but
given the reasons above, I think it should not totally replace physical audits unless you are an
organization whose operations are entirely virtual. With the faster pace of development in remote
technology brought about by the COVID-19 pandemic and the greater confidence on ICT from auditors,
however, I would not be surprised if I will have to write a follow-up to this blog entry soon.

Notes
1
International Accreditation Forum (July 4, 2018). IAF Mandatory Document 4: 2018 for the Use of
Information and Communication Technology (ICT) for Auditing/Assessment Purposes. Retrieved from
https://www.iaf.nu/upFiles/IAF%20MD4%20Issue%202%2003072018.pdf.
2
International Accreditation Forum (June 9, 2015). IAF Mandatory Document 5: 2015 for Determination
of Audit Time of Quality and Environmental Management Systems. Retrieved from
https://www.iaf.nu/upFiles/IAFMD5QMSEMSAuditDurationIssue311062015.pdf.
3
International Accreditation Forum (November 11, 2019). IAF Mandatory Document 5: 2019 for
Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management
Systems. Retrieved from
https://www.iaf.nu/upFiles/IAF%20MD5%20Issue%204%20Version%202%2011112019.pdf.
4
United Nations Industrial Development Organization (June 18, 2020). UNIDO Webinar: Auditing and
Management System Certification in a COVID-19 World. Retrieved from
https://www.youtube.com/watch?v=qgET1Xg1A3I.
5
United Nations Industrial Development Organization (June 18, 2020). UNIDO/ISO Webinar: Conformity
Assessment & Accreditation in Virtual World. Retrieved from
https://www.youtube.com/watch?v=qgET1Xg1A3I.
6
International Accreditation Forum (July 6, 2020). IAF Frequently Asked Questions COVID-19 Outbreak.
Retrieved from https://iaffaq.com/.