A remote internal audit uses communication and information technology to examine processes without every participant being physically together. It can combine interviews, controlled document access, screen sharing and remote observation. Its suitability depends on the audit objective and the evidence needed, not simply on whether a video call can be arranged.
Remote methods belong within the same internal audit programme as on-site work. They do not lower the criteria or justify unsupported conclusions. A mixed approach may be necessary when some activities can be evaluated remotely and others require direct observation.
Decide whether the objective is achievable remotely
Review the activities and evidence before choosing the method. An electronic approval workflow may be well suited to a secure system demonstration. Physical segregation, storage conditions or a hands-on operational task may need a different approach.
Consider whether technology will obscure important context. A camera directed by the auditee may not show the wider area. A screen share may display only a filtered subset of records. These limitations do not automatically make the evidence unusable, but the auditor needs to recognise and address them.
Do not select remote auditing solely to meet a date when the objective cannot be achieved. Record the reason for the method and identify any on-site follow-up or alternative evidence needed.
Agree access, privacy and practical arrangements
Confirm communication tools, access permissions, identity checks, confidentiality and handling of shared information. Test the connection before a time-critical session. Establish how participants will reconnect or pause if the technology fails.
Avoid asking employees to bypass access controls or send confidential information through personal accounts. Where record references are sufficient, do not collect unnecessary copies. If recording a session is proposed, address authorisation and retention rather than assuming consent.
Time zones, language, accessibility and shift patterns can affect participation. Plan sessions around the people and activities needed for the objective, with enough time for evidence retrieval and clarification.
Keep control of the sample
The auditor should select relevant cases rather than accept a prepared demonstration of only favourable examples. Ask how the population is defined, what filters are applied and whether different periods or exceptions can be examined.
A live system demonstration may help establish context, but it still needs judgement. Confirm which environment is being shown, whether the records are current and how the displayed view relates to the underlying process.
| Remote method | Useful application | Limitation to consider |
|---|---|---|
| Screen sharing | Trace an approval workflow | Filters or permissions may hide cases |
| Controlled file access | Review identified records | Export may omit system context |
| Video observation | Examine selected physical activities | Camera view may be incomplete |
| Online interview | Understand decisions and responsibilities | Statements still need relevant corroboration |
These are planning considerations, not a declaration that every technology is acceptable for every audit.
Examine digital evidence carefully
Screenshots and exported reports can preserve useful information, but they may omit timestamps, definitions or excluded records. Ask what the evidence represents and how its authenticity and completeness can be evaluated.
When a record is unavailable, distinguish a technical access problem from failure to retain required information. If the connection prevents a conclusion, record the limitation and arrange further work. Do not automatically turn every technology failure into a nonconformity against the process being audited.
Conversely, a remote format should not hide a demonstrated gap. If the evidence establishes that required authorisation was absent, evaluate it against the relevant criterion just as an on-site audit would.
Adapt interviews and observation
Remote conversations can make it harder to see hesitation, interruptions or who else is influencing the answer. Use clear questions and check understanding. Give participants time to retrieve evidence rather than filling every pause with a suggested answer.
For physical demonstrations, agree a safe method. Do not ask someone to operate equipment while carrying a device if that creates a hazard. An auditor’s need for evidence does not override operational safety or security controls.
If the selected view cannot show the relevant condition, choose another method or acknowledge that the objective remains partly unfulfilled. A convenient image is not necessarily adequate observation.
Report what the method supported
Record which activities were remote, the methods used and material limitations. Explain any scope changes, interrupted sessions or areas deferred for further work. Conclusions should reflect actual evidence coverage, not the original plan alone.
The independence and objectivity article discusses another condition that technology cannot solve by itself: the ability to evaluate fairly without conflicting responsibility for the work.
Review the remote approach after the audit. Consider evidence quality, participant access, time spent resolving technical issues and whether the objectives were met. Remote auditing is a method to evaluate, not a presumption that travel is always necessary or always avoidable.
For sensitive evidence, agree whether the auditor may view information without retaining a copy. Documenting a controlled reference and the conclusion can sometimes meet the audit need while reducing unnecessary duplication. The arrangement should still permit an adequate review of the finding.