Remote working and paper documents

9 April 2020

COVID-19 has led to a large number of us working remotely and this has given us new challenges and opportunities. As auditors, this new way of working raises a wider question around what assurance are we providing if we are not sitting next to someone, not seeing the paper documents for ourselves etc.

As we adapt our audit plans to address the emerging risks, managing without key paper documents is a wider emerging issue which businesses are having to address.

So, what should internal audit do?

First stage is probably to ask ourselves if we can get hold of the ‘paper’ evidence. Where we are providing assurance on a real time basis over new controls being performed in a remote working environment then we do need to consider how the business is getting assurance that the key control is operating effectively without the physical document. We should be able to mirror what they have done, are doing or if we can’t then the question is – ‘is there is adequate oversight’?

The next stage is to consider if there are any other ways, we can gain assurance without physical documents such as:

• reading through electronic committee minutes/papers where the documents may have been discussed
  
  
• obtaining e-mail conversations where drafts of the key documents may have been attached and challenged and so they might provide assurance around the governance and challenge
  
  
• consider if elements of the key document can be extracted from other sources
  
  
• where some staff may still be working in the office can they show us the document through video communication or digital photography
  
  
• external confirmation may be an important source of relevant reliable evidence, obtained as a direct written response to the internal auditor from a third party (the confirming party) in electronic medium seeking information of a knowledgeable person within or outside the organisation, that may provide new information to the auditor or corroborative audit evidence.

If, however, we can’t find other assurance then it might be that we have to rely on management representation. Then we need to make sure our audit working file reflects what we have done, and we are clear around any limitations of our review and this is reflected in the internal audit report and the opinion.

Ultimately, we will need to be pragmatic and this is another example of the ways we are adapting to stay relevant in the current COVID-19 scenario but at the same time be aware of any industry specific regulations and any data privacy requirements.