.png)
A couple of weeks ago, I had a chat with Craig Thornton from Mango Limited to discuss the importance of remote audits during this unprecedented time. I gave some insights into how remote audits can be conducted in the most effective way, based on my many years of auditing experience.
Here is the video recording from the webinar chat we had, I hope you find it useful in getting an insight into remote auditing.
What's the purpose of auditing?
The purpose of internal auditing stays the same whether it's remote or site-based - you as a business are required to verify that processes are implemented as planned and that aspects, hazards, and risks are managed.
Audits are not only about the process and procedures, you need to consider the outcome.
Are you providing a safe workplace? Are you managing environmental impacts? Is your product or service meeting customer needs?
Audits can be really useful in identifying any gaps and improvement opportunities in those kind of areas.
The main point here is that remote and on-site audits are done for the same business reasons and same business benefits - keep that in mind throughout this blog.
Why Remote Audit?
Obviously, the current situation of being in lock-down due to COVID-19 is a good example as a benefit of remote auditing. Remote auditing may allow you to continue with your internal audit program, as well as minimize any other site access issues.
Costs:
Every business I've ever been to has always got a limited budget for internal audit programs, so remote audits can be cost effective.
Geographic Dispersion:
Could you get better outcomes from your audit program if you plan and schedule some critical audits on site? Using remote auditing would result in a reduced cost to more frequently audited sites that are geographically dispersed or cost a lot to travel to.
Increasing number and frequency of sites audited:
If you're a water body, for example, in a large site like Western Australia or Queensland, and have hundreds of sites, remote auditing may allow you to increase the frequency at which you actually visit some of these sites.
More Responsive Audits (Incident)
Another opportunity with remote audits to is to conduct a very responsive audit. If we've got a site far away from where the auditor is based and there's been an incident, near misses, or performance is dropping away - as an auditor, you could organize a remote audit around the related Safe Work procedures.
Planning and Preparation
If you've watched any of my other videos, you'll see that even on a normal audit, when you are intending to visit a site, planning and preparing is the key to a successful audit that offers your business a real value.
If you are planned and prepared, you will understand the processes on the Safe Work procedures you're meant to be auditing, what some of the hazards and risks are, and perhaps some of the related compliance obligations. That's going to be a much more effective audit than turning up and we've got no idea of any of that.
Remote Audit Planning:
Some of the things you need to work through in your planning and preparing for the remote audit is talking to the auditees about the kind of tools and software systems that will be used to conduct the remote audit.
You're not going to be able to physically observe with your own eyes, so you need to think about:
What plant and equipment they have on site
Who is responsible for doing what on site
Plan the arrangements around information, which will depend on what remote audit methodology and tools you're going to use. For example, If I'm auditing Craig and he's going to send me some documents afterwards, or I'm going to view them via share screen mechanism, what happens with that electronic documentation? What's the rules around information security, given there's additional technology used.
It's also fundamental that you outline the objective for each and every specific audit that you do. As an example, to verify storage and handling of chemicals is consistent with the related Safe Work procedure.
It's probably worth asking yourself whether the objective you have outlined is actually achievable via a remote audit. There can obviously be some limitations, as well as the remote audit objective possibly influencing what kind of tools, equipment, and software you attempt to use.
Physical Audit Plan
A physical audit plan is the document you sent to the auditors ahead of time. I really think this is more critical for a remote audit, given we can't be in the same room as the auditees.
Some things that should be outlined in the audit plan are:
What the criteria of the audit is
Personnel - who do we need to interview
Timeframes - when do they need to be available
Activities
Documentation/Records you will need
How you will review information
One thing I do emphasis is that it's the auditors responsibility to keep things on time. If somebody goes off track, you need to manage that and make sure that you're ready for that next appointment. In remote audits, if someone is sitting there waiting for you to log into the system but nothing's happening, the audit can fall over very easily at that point.
What are the Risks of Remote Auditing?
Certification bodies will be looking at the risks and opportunities of the remote audits, to figure out if it is worth it to go ahead with the remote audit.
Some of the key risks that could be more difficult to manage or impact on our audit objective are:
Communication could be lacking
It may be easier for the auditee to hide something if you're not on site
The auditee may feel uncomfortable due to lack of awareness around the remote interaction technologies
What are the Opportunities of Remote Auditing?
Ability to cover more sites
The costs will be reduced - no travel costs
Can talk to or interview more people over short period of time
People and Remote Auditing:
One of the things we always emphasize in our internal audit training is to manage people and communicate effectively, because auditees can often be a bit nervous or threatened by the process.
Take time to put people at ease, you can do this by:
Breaking the ice
Explaining the objective
Emphasize that you're here to audit system processes, not to find fault with people
Letting them know how audit findings are dealt with
It may be difficult to get a gauge of when the auditee is uncomfortable. I have seen very skilled auditors who've got excellent perceptive people skills, and in that case you might be OK. But, most people don't stick up their hand and say, "Hey, Mr. or Mrs. auditor, I'm really nervous and uncomfortable", they tend to show it through their non verbal communication.
That's where a skilled auditor will excel - if they start to get a bit of a gut feel that this person's not that comfortable, they can take some preemptive steps to just try and reinforce what we're doing and make the auditors more comfortable.
You need to set aside extra time for planning and preparing some strategies that will help put people at ease prior to the remote audit.
Remote Auditing Equipment:
I do see an increasing amount of organizations where people within the organization are more comfortable and familiar with the webinar and screen sharing technologies, compared to 3,4,5 years ago.
Just on Wednesday I completed a remote audit with an engineering consultancy that's got offices all around Australia. It went very smoothly. I was able to speak to different project managers at different times. They're all very comfortable with the technology.
That point I made earlier about time management, leaving a break between events. You don't want to be trying to sign off with one project manager at 10:29 and then trying to log in and speaking to the next project manager at 10:30, so make a bit more of a gap than normal.
The point I'm trying to make is that people are more comfortable, at least anecdotally, with some of the technology. That same company I tried to audit remotely about three or four years ago, and they got cancelled after five minutes because they just couldn't get it going at their end.
You need to test and agree on these things at both ends:
cameras
audio
software
information security and access rights
Remote Audit Process
When it comes to remote auditing, if anything, you need to be a little bit more formal than usual. You can be relatively informal on a site-audit when you already know everyone and have met the team. But in a remote audit, you probably need to go the other way and be a consider things like communication opportunities, opening and closing meetings, clear timeframes and breaks.
Site Tour:
Personally, I tend to ask for a bit of a site tour. If I am on site doing an audit fairly early on in the process, they're very valuable. You can see some of what's happening well or not so well, and what plant and equipment is being used and who's on site. It's still good practice in a remote audit, but work out through what means you're going to do that.
Communication:
If you're working as part of an audit team, you need to communicate and update each other more regularly than a normal audit. When I do site-audits, I tend to debrief auditees and let them know how everything's going.
With your key contact person on site, if you have that arrangement where you say, if there's any actionable findings, we'll raise them with society manager in the first instance. And then communicate it to them. I think those formal communication channels with a key contact and more important in a remote audit.
Reflective/Clarifying Questions:
Different styles of questions can be used when interviewing people, to both put the auditor at ease but also to uncover the information and evidence that you need.
The purpose of a reflective or clarifying question is to start our next question with a statement that reconfirms what we've heard in in the auditor's response to the previous question. Auditors really like these questions, because if Craig is interviewing me now, it signals to me that Oh, yes, Craig understands what I've just told him.
It's a way of building confidence within the auditees that you are treating their information appropriately, and you understand it.
So if Craig's just given me a response around something that's really critical, that's a good time to ask a reflective or clarifying question to say, "Well Craig, let me see if I understand, when you inspect the incoming goods, you check x and y and z, and then it needs to be signed off by the warehouse manager?" And then I go into my new question.
It also gives the auditees a chance to say "Well hang on Andrew, no, we don't always check x, y and z some days, we need to apply a different checklist instead". So it shows them you're listening, it shows them your understanding the critical points, and it gives them the opportunity to confirm that you understand things correctly.
So the big tip is that I would probably ask a few more of those than in a normal audit. Take extra time to confirm and communicate findings, any action required, particularly if there's any non conformance findings.
Take Extra time to Confirm Findings and Action (Particularly NCR)
When you're writing your report, be a clear about what the evidence was, who you were interviewing, what the document or record was that demonstrated non-conformance. In a remote audit, I think there's an argument to say it's important to be a little bit clearer because that audit report becomes your key record of the audit immediately and into the future as well.
So if Craig's got to conduct the same audit in 12 months time, and there's nothing recorded about how I determined conformance, or non conformance is it's going to be more critical.
Failure of remote tools
Another really important point that I have seen some misunderstanding around is where I will say that it's a non-conformance because the auditors couldn't demonstrate that they've got a safety data sheet. If the underlying reason is because of their remote already tools, that really shouldn't be an answer.
You've got two choices:
State that you couldn't determine conformance or non-conformance with this requirement for this reason
Ask them to send you additional evidence once the remote audit has taken place
We can't really blame a failure of the remote auditing tools as a reason for why they couldn't demonstrate conformance, because perhaps they could have if those tools were working properly.
If you found this blog useful and would like to check out some of my other Auditing content, you can do so here: