During these difficult and uncertain times, the CPA profession is steering through untested ground: remote auditing. Though the accounting profession is not crippled by social isolation, as seen with restaurants and entertainment businesses, auditors have traditionally relied on varying degrees of physical proximity to accomplish our audit objectives. Audit site visits are the most obvious example of how practitioners capitalize on proximity to perform their duties.
Although some states are beginning to transition out of stay-at-home orders and travel restrictions, uncertainty persists over the permissibility and safety of travel. It is therefore incumbent on auditors to reject notions of imminent returns to the status quo, nor should we rely on any such assumption as a basis for planned fieldwork. Auditors must adapt to the obscurity of what lies ahead by embracing remote auditing methodologies.
Remote auditing as a concept is actually common in today’s technology-driven world. Gone are the days when auditors would tote crates filled with workpapers between the office and home, and when teleworking would be an absurd request of one’s supervisor. Today’s CPAs have an ever-growing arsenal of technological means to perform an audit from a cubicle or a home office. As we have seen with computer-assisted audit techniques, electronic workpaper binder systems, email, robotics, and the dawn of data analytics, technology has allowed auditing to be more efficient while retaining its effectiveness relevant to the audit objectives. With these resources, auditors can now perform site visits virtually.
Furthermore, generally accepted auditing standards (GAAS) establish measures of the sufficiency and appropriateness (quantity and quality) of audit evidence in order to reduce audit risk to an acceptably low level. In fact, GAAS rarely dictates or limit how audit evidence is obtained. GAAS accounts for the differing nature and circumstances of each audit, and the design of audit procedures is generally deferred to the auditor’s professional judgment.
As opposed to other forms of audit evidence reliability, such as those derived from original documents or external sources, site visits produce evidence obtained directly by the auditor. If used properly, audit evidence obtained through telecommunications, as well as video or photographic means, can be just as reliable while only sacrificing three of the five senses (taste, touch, and smell), which auditors rarely use in their professional lives.
Site visit objectives vary, but mostly they are conducted to perform transaction cycle walk-throughs, to inspect facilities to observe physical controls (e.g., system security) or other control activities, to attend physical inventory counts, and to test fixed assets. These site visit objectives, and remote auditing methods and reasoning, are discussed in more detail below:
- Walk-throughs are performed to obtain evidence of transactions, or a group of transactions, from initiation, authorization, processing, recording, and reporting (cradle-to-grave). Walk-throughs involve inquiry, observation, examination/inspection, and reperformance procedures. Any one of these procedures can generally be performed through videoconferencing or other forms of interactive media (such as screen sharing), including observation. Inspections of facilities can likewise be performed through such means, and modifying the nature of these procedures through video or photograph, if done properly, retains the audit evidence reliability (appropriateness). For example, observing physical controls of key card access to facilities can be accomplished through a real-time video call. Relevant to auditing information systems, more and more entities have downsized the number of server facilities and adopted more cloud-based servers, essentially decentralizing and, in many cases, outsourcing their information technology infrastructure. This continued trend leads auditors to depend more on the results of reports under Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification, for physical and environmental controls of the hardware service providers, in which case a site visit might be redundant.
- Physical inventory counts are performed to evaluate and observe management’s controls and procedures related to its inventory process, as well as inspect the inventory and perform test counts. Although this procedure is presumptively mandatory, it is not unconditional. Application guidance for AU-C Section 501, Audit Evidence — Specific Considerations for Selected Items, specifies the use of “alternative audit procedures,” specifically for when attending physical inventory counts is impractical or unsafe, and such guidance should be referenced during this pandemic period.
- Fixed asset testing on-site involves a variety of procedures mostly to test management’s assertions related to existence and completeness. Existence testing through video or photographic means parallels the reliability of an on-site presence if certain measures are taken to ensure its accuracy. Such methods can include time-stamp photographs, such as digital camera date displays, or requesting management to frame in an artifact provided by the auditors, such as that day’s newspaper. Other methods could include reporting outputs, verified though other audit procedures, that validate the asset’s existence through unique identifiers (such as is the case with certain types of existence testing for satellites). Completeness testing can also be accomplished by requesting a video tour of warehouses or business premises, and auditors can make real-time test counts or choose to analyze the evidence and provide management with its test counts at a later time. Auditors should also ensure that audit procedures over similar accounts or transactions are performed concurrently to further reduce audit risk over the completeness and accuracy of evidence obtained.
It is also important to note that, considering the nature of remote auditing, management must provide written representations that it has provided the auditor with all relevant information and access, as agreed upon in the terms of the audit engagement.
Ultimately, reasonable assurance is a matter of professional judgment. It is an understandable concern that modifying the nature of site visit procedures through these means may elevate audit risk. However, concluding that an inability to perform a physical site visit is a scope limitation and modifying the audit opinion without considering if other procedures can be performed to compensate for the elevated audit risk is a disservice to our clients. Using these tools creatively can help practitioners perform high-quality audits despite the challenges presented by the pandemic.
— Reza Mahbod, CPA, CGMA, is president, and Mike Fredrickson, CPA, is a director over the federal audit practice, both at RMA Associates LLC, a firm in Arlington, Va., that provides federal government-focused audit, consulting, and advisory services. To comment on this article or to suggest an idea for another article, contact Ken Tysiac, the JofA’s editorial director, at Kenneth.Tysiac@aicpa-cima.com.
