Audit Pl

Questions

Are all planned audits still essential?

Should we cancel or delay audits of lower-risk activities?
How should we consider the priority of planned audits, considering that fewer auditors may be available if they become sick or need to
care for family members?
Are there any engagements that we wish to keep but convert to a different type of interaction, such as a high-level review, a targeted
review or advisory support?
Can all planned topics be audited remotely?
Should we plan for teams to execute the parts of engagement scope that require on-site verification partially now, producing partial
conclusions, and complete the rest of these engagements later, once travel is permitted?
Is it still feasible to conduct the planned audits on the scheduled dates?
Are key auditees still available for the needed amount of time?
Should any audits be delayed or refocused because key auditees are no longer available?
How will the procedures (e.g., inquiry, inspection, observation) of planned audits be impacted by remote work? Have we adjusted/cut
the scope accordingly?
Can auditors now work simultaneously on different audits or simultaneously audit the same topic at different locations using remote
auditing techniques?
Can we temporarily reassign any auditors to support other important activities in the organization, if their initially assigned activities
have been delayed or removed from the plan?
Is our co-source provider able to work remotely and be as efficient, rigorous and secure as needed?

Should we coordinate our changed audit plans with other internal assurance providers to leverage their work, or vice versa?

Can auditors work with other assurance providers to leverage their work or to execute the work more efficiently?
Should we share our changed audit plans with external audit, regulators and others to understand their revised plans and expectations?

What information should we provide to senior management and operational management (auditees) about the planned audits — for
example, changes to timing, scope, meetings, feedback, reporting and methods that will now be executed remotely?

Will our new approach impact the quantity and/or quality of the assurance we can provide to the audit committee?
Audit Planning

Notes and Required Actions

 Team Man

Questions

What is our process for listening to auditors, learning and developing our way of working as we use remote auditing more frequently?
How will we adjust auditor performance goals and objectives while working remotely?
Specifically, how will productivity expectations change?
What are the unique management challenges posed by remote working?
Is it more difficult to motivate, coordinate and communicate with teams who are based in multiple locations?
What can we learn from other assurance teams in our company that may already be working remotely, such as ISO, quality auditors or
any assessors of hazardous operations?
Once the threat of coronavirus recedes, how will audit evaluate the lessons learned and possible benefits of continuing to deploy
remote auditing as a technique at our organization?
Team Management

Notes and Required Actions

 Techno

Questions

Do we have access to the necessary systems and data to conduct the planned audits?
Can we make requests now for access to data and systems to give auditees ample lead time -- even several quarters' worth -- and
ensure teams have access when they conduct audits later?

Remote workers are always less secure when using technology. How will we refresh auditors' IT security training and awareness?
For example, how are we reminding auditors to safeguard sensitive information when they are working at home, speaking with auditor
colleagues, interviewing auditees and reviewing data online? Are we ensuring they are aware of any other people also working from the
same location whose access to sensitive information should be prevented?

Are auditors subject to any legal restrictions on accessing data or moving any downloaded data from one country to another?

Do auditors working remotely have the right work environment, technology, network capacity and network links and software licenses?
Do our technology-savvy auditors have capacity to assist colleagues who are less confident in using technology to work remotely?
Technology

Notes and Required Actions