Remote Internal Auditing in a New Normal World While it may not necessarily be “the oldest profession in the world”, the auditing profession has certainly been around a long time. Relics from the Mesopotamian Empire (circa 3,600 to 3,200 BC) reveal little ticks, dots and circles next to numbers, indicating that there was a thriving auditing community busy at work checking things in the Ancient Iraqi Empire1 (which history records, invented the wheel). Skipping ahead a few thousand years, the Romans appear to have spearheaded the concept of segregation of duty controls. No administrator in the Roman Republic was allowed to process orders, and at the same time, handle cash2. And to bring it all home, the records of the City of Dublin3 from (the relatively recent) 1316 notes that “tallages (i.e. taxes) and imposts to be collected under supervision of four or six good men duly sworn, and accounts to be rendered of receipts and payments before the commonalty of their auditors”. In this manner, history teaches us that auditing has been around for a very long time. And when we consider how auditing must adapt to a COVID-19 world, it is important not to lose sight of the fact that auditing has survived through all of history’s great catastrophes. Mesopotamia fell to the Greeks and Romans, but the practice of ticking numbers survived. The Roman Empire in turn, fell to Germanic tribes, but segregation of duty controls survived. Auditing certainly has a rich history of resilience. The COVID-19 Environment And now the auditing profession is faced with COVID-19. In May 2020, the Government of Ireland released its “Roadmap for Reopening Society & Business”. While the Roadmap sets out a gradual modification of elements of the current measures in place, the general principle is that social distancing will remain a feature of Irish society for the foreseeable future. In this regard, the purpose of this article is to consider how internal audit can adapt to the changed environment that COVID-19 presents, with particular emphasis on remote internal auditing. It is important to note that the term “audit” is ubiquitous, but in this article, audit should be taken as referring to “internal audit” as defined by the Institute of Internal Auditors (“IIA”), and, as deployed to the Irish credit union system. That said, the Irish credit union system has a wide range of assurance providers, and this article may be of relevance to other assurance providers who form part of the ecosystem. What is remote internal auditing? Remote internal auditing means conducting an audit remotely, i.e. distant from the location of the auditee, through the use of conference calls, video conferencing, secure data portals and other relevant supports. It would be reasonable to comment that remote auditing has been a feature in Irish credit unions over the past number of years, prior to COVID-19, as the technology has been in place. But up to now, it was generally coupled with physical onsite visits (either to conduct substantive tests, or more commonly to conduct planning meetings, close out meetings or to meet audit committees). In many ways, what COVID-19 has resulted in, is a rapid acceleration of a process that was already well underway. In a recent USA briefing document issued by the IIA, in conjunction with the Environmental Health and Safety Audit Centre, the growing importance of remote auditing was summarised as follows4: “The conversation about new audit approaches, use of technology, and remote auditing techniques has gone on for several years. However, in various polls of companies conducted over the past two years, few firms report implementing remote auditing beyond test scale. The emergence of COVID19 and its related worldwide travel restrictions, combined with the existing need to conduct regulatory, legal, or immediate need-driven audits, are renewing the conversation and focusing internal audit efforts on finding alternatives to the traditional face-to-face audit that can be implemented now.” The key elements of remote internal auditing The components of a remote audit are in many ways analogous to an in-person audit. Generally the internal audit process can be broken down into the following phases; planning, document review, fieldwork, interviews, and closing meetings. This remains the case for a remote audit. However, in a remote world, these phases could be further refined into two central themes: Sufficient information to conduct fieldwork remotely to enable an assessment of the subject matter of the review to be made. Sufficient communication capability, to effectively plan, conduct interviews and facilitate closing meetings. Each of these themes will now be considered. Theme One - Sufficient Information The IIA have developed International Standards for the Professional Practices of Internal Auditing. They include principles and requirements for undertaking professional internal auditing and for evaluating internal audit performance. On the matter of information, Performance Standard 2300 provides that internal auditors must identify, analyse, evaluate and document sufficient information to achieve the engagement’s objectives. Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Modern digital technology supports the transmission of documents at speed in a GDPR secure manner. In the modern world of high speed data transmission, auditors therefore have a wide choice of technological supports to obtain information remotely. And what COVID-19 is likely to do, is extend this further. In more recent guidance, post COVID-19, the Chartered Institute of Internal Auditors (the UK and Irish arm of the global IIA) has acknowledged this reality: “Whether it’s for continuous monitoring or specific data analytics, accessing and interrogating the organisation’s systems is now the norm for most functions. Carrying out tests on physical elements, however, may require creative thinking. If you need to review physical access to a site, you may normally rely on a combination of electronic records (for swipe card access), security camera footage and physical observation. Remote video linking can replace on-site observation for the last elements, and screen-sharing allows you to walk through processes.” The Chartered Institute of Internal Auditors goes on to comment on the need to adapt the general healthy scepticism that internal audit ought to display on information that is presented: “As with any document, you can check the provenance and other attributes by inspecting document properties. Photographs of signed documents should give you a sense of their reliability. If, for instance, a signature looks erased and overwritten, follow up as you would normally.” In this regard, the general conventional wisdom is that there is no sacrifice in reliability of information to support internal audit conclusions when obtained in a remote context. In many ways, this was already widespread in the auditing world, pre COVD-19. And COVID-19 may very well just bring completion to a process that was already well advanced. Theme Two – Communication capability This is where recent studies become interesting. Again, there is widespread acceptance that the necessary technology is in place to enable sufficient communication for remote auditing. One of the more striking aspects of how Irish business and society has adapted to COVID-19, has been the rapid shift into the world of enterprise video communications. Overnight, we have become a nation of “Zoomers”. But what both the Institute of Internal Auditors and the Chartered Institute of Internal Auditors are at pains to point out is, how this needs to be carefully managed. In the aforementioned USA briefing document, issued by the IIA in conjunction with the Environmental Health and Safety Audit Centre, it was put as follows: “First-hand observations cannot be replaced. There is nothing like seeing processes first-hand, observing body language…..remote auditing makes it hard to build rapport with auditees. Opportunities to provide hints, tips, and observations for improvement are lost. It is hard to identify best practices or describe things that others may benefit from, outside of the documentation process. Good auditors do this, and these are often the most useful things that auditees get from the exercise….” This point was echoed by the Chartered Institute of Internal Auditors as follows: “Better to acknowledge we do lose information when not interacting face to face. Even using the applications mentioned earlier, we typically see only the face – not the body language. Subtle hints we pick up on in person can be lost, and this is even more the case in telephone and email exchanges. The Institute guidance on communication skills covers different communications channels. This will help you adapt your message to the medium – allowing, for example, longer pauses. You are likely to need to prepare more open-ended and follow-up questions than usual, too. Someone you speak to by telephone may need to be coaxed more than would be the case in person.” Based on this, the key challenge of remote auditing is not really “technical”, it is more to do with the nuanced skill of communication. How do you read the “mood in the zoom-room”? This is a skill that will of course evolve. There is already a burgeoning video conferencing etiquette. Everyone mutes when the speaker speaks, videos are switched off to enhance connectivity, and screens are being shared to visually communicate key points. The world is adjusting. Like it always does. It is likely that at some point (in the not too distant future), we may look back at traditional face-to-face meetings, as being cumbersome and inefficient. The inability to cast your screen may suddenly become the new problem. In this regard, modern meeting practices are evolving. The new normal may well become simply normal. Conclusion Remote auditing brings a wide range of benefits. It enables an expanded audit coverage, expanded use of specialists, improved document reviews, improved use of technology, less drag on operations and a greater ability to engage on a multi-level basis with the credit union using video communication technology. The technology is already in place and has been widely used. Now it just needs to be used more to bring the process in its entirety from cradle to grave, on a remote basis. It is interesting to note that the word “audit” comes from the Latin word “audire“ which means “to hear”. From the Mesopotamian tickers, to the Roman Empire bureaucrats, to the 6 “good men” in Dublin in 1316, auditing has been about effective listening. As auditing steps into a COVID-19 world, with all of its strangeness, effective listening will remain the central audit challenge. It was ever thus…… Brian Hayes | Partner | Cork Brian.Hayes@mooreireland.ie +353 21 427 5176 References Accounting by the Ancients, Kenneth Most (1959) A History of Accounting and Accountants Edinburgh (1905) Calendar of Ancient Records of Dublin, Gilbert (and translated from the Norman-French) Remote auditing for COVID-19 and Beyond Short-term and long-term implications By Roy Litzenberg, CPEA, and Carrie F. Ramirez, CIA, CHMM, CDGP IA at a distance: conducting audit engagements remotely, Chartered Institute of Internal Auditors (2020)