Audits provide an essential tool for improving and verifying compliance performance. Audits may be used to capture regulatory compliance status, management system conformance, adequacy of internal controls, potential risks, and best practices.

Most regulations, standards, and guidance require audits to be conducted with some established frequency. For many companies, figuring out how to meet these audit requirements amongst travel restrictions, new company safety protocol, and government quarantines related to COVID-19 presents a significant new challenge.

The Online Alternative

Companies come in a variety of sizes with a range of different needs. Because of this, auditing standards remain fairly flexible by design. Fortunately, this allows for online/remote/virtual audits as a viable alternative to onsite audits—provided the audits:

• Are planned well;
• Appropriately leverage technology; and
• Are executed by a team who understands the facility and the requirements.

The ultimate objective of a virtual audit remains the same as an in-person audit: To obtain credible audit evidence to accurately assess compliance/conformance with identified requirements/specifications. The difference lies in the means in which that evidence is collected (i.e., live stream video, surveillance cameras, group web meetings, electronic document review).

Weighing Risks vs. Rewards

Audits can be conducted onsite, remotely, or a combination of the two. In many cases, companies may already be having portions of the audit (e.g., document review) done remotely. Moving the entire audit to the virtual world allows credible evidence to be obtained in unique ways that can offer significant benefits to a company when onsite audits aren’t possible—and even when they are:

• Reduced cost – Online audits eliminate the expenses associated with travel (i.e., mileage, flights, hotels, meals), which can add up depending on the location and duration of the audit.
• Flexible schedule – Remote audits can be conducted on a more flexible time schedule. Auditors do not have to complete work onsite in a set number of days, as is required when traveling to a facility. The auditor can also review areas in question remotely after the audit is technically over. Note that a more flexible time schedule does not necessarily mean less time involved to conduct the audit.
• Social distancing – As CDC guidelines have recommended, it is currently safest to work remotely, when possible, or to remain six feet of social distance to avoid potential transmission of COVID-19. Through the use of technology, virtual audits provide a social distancing extreme.
• Improved systems – Preparing for a virtual audit provides the “push” some organizations need to improve electronic storage systems. To conduct a virtual audit, documents and records must be retained in an organized manner that facilitates easy/quick access. Being able to access all documents remotely is necessary—paper records or documents stored on individual computers/network drives no longer cut it.

At the same time, there are some potential risks to conducting a completely virtual audit, particularly since this practice is relatively new to many organizations:

• Observation/technology limits – Observation of site conditions is limited by the ability to direct live stream video remotely. Technology can create limitations. If the camera can’t see it, neither can the auditor. Poor video quality can impede visual clarity. You don’t know what you don’t know.
• Communication confusion – It can be difficult to read body language and/or interpret emails and phone conversations to make sure communication is clear. This can require revisiting topics/findings several times to ensure accurate evidence is collected.
• Time barriers – There may be time zone and associated scheduling barriers depending on the location of the auditor and the facility.

Considerations and Best Practices

Regardless of the type of audit a facility conducts (i.e., remote, onsite, combination), standard audit best practices should be followed to ensure that audit results are comprehensive and credible. If the company opts for a virtual audit—for any reason—there are a number of considerations and best practices to ensure that the audit effectively fulfills its objectives and alleviates the risks outlined above to the extent possible:

• Site Familiarity – Virtual audits work best if auditors are familiar with the industry and/or operations. While it is not necessary for the auditor to have visited the site before, that type of familiarity with the facility provides the best-case scenario, especially for compliance audits, as it prepares the auditor to know what to look for (and where) and what questions to ask.
• Careful Planning – Much like onsite audits, virtual audits require careful upfront planning on the part of the auditor and the facility—and perhaps to an elevated degree.
  • The facility needs to collect all documents and records prior to the audit and determine best way to present that information remotely (e.g., email/transfer ahead of time, allow access to company Intranet/shared directory space, share during a web meeting).
  • Interviews are best scheduled in advance to ensure availability; however, they can be conducted on an ad hoc basis as need arises.
  • It is best to plot out route and areas of specific focus for the audit ahead of time using a site map as a guide to ensure that all areas are covered and that the audit can be conducted as efficiently as possible using the allocated facility resources. An audit site guide must be assigned who is familiar with the entire facility.
  • Technology needs and requirements must be evaluated, and logistics and access should be tested prior to the audit. It is vital that all cameras, web meetings, shared document space, WiFi, and other technology is working appropriately prior to the audit or a lot of time can be wasted troubleshooting issues.
• Video – Videos should be live. Site walks should be led by a site guide/employee along the planned route with smart phones, iPads, etc., with live streaming capabilities. It is important to ensure that live streaming works within the facility being audited so auditors have a clear view of site conditions. Auditors can also take advantage of any in-house surveillance cameras (e.g., security or quality systems) to provide additional footage of operations, when necessary. In most cases, surveillance footage cannot replace live video.
• Web Meetings – Opening, closing, and daily briefings can be conducted via web meeting. Remote audits provide the flexibility to conduct the audit in segments, with briefings following each segment. This allows the auditor to review video footage, evaluate records, and generate questions to ensure the information collected is accurate and complete.

Companies all over the world are working through a transition period right now, where they are trying to establish what a new “normal” looks like when it comes to operating practices, employee health and safety, business continuity, and compliance. Audits are one piece of the overall puzzle that can be transitioned somewhat seamlessly with the right planning and technology in place to ensure ongoing compliance.