A remote audit is still an audit: the auditor needs evidence, from real people and real records, that is reliable enough to support a conclusion. What changes is how the evidence reaches the auditor, and where that route is weaker. Used well, remote methods save travel and cover more ground. Used carelessly, they let the auditee control what is seen.
Last reviewed: 17 October 2026. Facts checked. We opened web search results on the FSSC 22000 requirements for use of information and communication technology (ICT) in audits, version 6, and on the IAF mandatory document on ICT (MD 4), which those results say certification bodies must use as a normative reference. These are secondary descriptions; we did not read MD 4 itself. Whether a remote method is allowed for a given certification audit depends on the scheme and the certification body. Ask yours; we state no general rule.
What counts as remote
Terms overlap, so be clear which you mean:
- Remote audit component: document review and interviews by video or screen share, with another part of the audit done on site.
- Fully remote audit: nothing on site. Per the FSSC material we opened, this is a narrow, conditional option for that scheme and not an everyday substitute. Other schemes differ.
- Remote internal audit: your own staff auditing another site or function by video. You set the rules, but the evidence logic is the same.
The FSSC material describes the ICT approach as voluntary and agreed in advance between certification body and client, with a remote component followed by an on-site one. That is one scheme, not a universal pattern.
What works well remotely
- Document and record review. Shared screens or secure folders let the auditor read procedures, registers and reports. Often more efficient than paper.
- Interviews with management and office staff. A video conversation is a reasonable way to explore decisions, objectives and review minutes.
- Remote access to systems. Watching a user pull a report from the live system is better evidence than a pasted screenshot.
- Opening and closing meetings. Simple and low risk.
What is weaker remotely
- Physical conditions. Housekeeping, safety, segregation of nonconforming goods, calibration labels, storage: a camera shows what the camera operator points at.
- Real work observation. A planned demonstration is not the same as watching work happen when no one is expecting you.
- Informal signals. Body language, the feel of a workplace and the interview you have while walking.
- Technical failure. Poor connection can truncate evidence without anyone noticing.
If the audit objectives depend heavily on those weaker areas, say so in planning and consider whether a site visit is needed.
Techniques to protect evidence quality
- Request records before the call, in a controlled way. Ask for the source list (such as all purchase orders) and choose your own sample. Do not accept a folder of pre-selected best examples.
- Prefer live over pasted. Ask the process owner to open the system and search while you watch. Ask for a different filter than the one they prepared.
- Check the date and source. A screenshot may be edited or old. Look for system dates, file properties, user names and any link between the record and the event.
- Use live video tours with direction. Ask the person to carry a camera or phone to a specific location and to turn it as you direct. Ask to see the entrance, the stores or a given machine. Note that the auditee holds the camera; stay alert to what is not shown.
- Interview people alone where appropriate. On video, a manager can sit just off camera. Ask who else is in the room. Confidentiality is a core audit principle.
- Record what you saw, not what you were told. In the working notes, state: "viewed by video; operator carried a mobile camera to the goods inward bay; seen four pallets unlabelled." The method is part of the evidence.
- Allow extra time. Remote sessions tire people; shorter sessions with breaks usually work better than one long one.
Confidentiality and security
Sharing screens and documents creates risk. Before the audit:
- Agree the platform and who can attend.
- Agree whether sessions may be recorded; do not record without consent.
- Use secure transfer for records, and agree retention and deletion afterward.
- Take care with personal data; for Indian organisations, think through what personal data of staff or customers appears on screen and whether it is needed.
Our post on prompt injection and data leakage when using AI tools in audit covers a related caution for anyone using AI note-takers on audit calls.
Preparing the auditee
Send a short note: the platform, test call time, who must be present, which systems will be shared and what records will be needed. Ask for a named person to deal with technical problems. A test call a day before saves a surprising amount of audit time.
Reporting limits honestly
The report should say which parts were done remotely and which on site, what technology was used and any limitation that affects confidence, such as a failed camera link for a site area. If a conclusion rests on a remote view of a physical condition, say so. See the audit day sequence for the usual flow that remote audits should still mirror.
An invented example
An internal auditor audits a branch warehouse by video. The warehouse lead shares a stock register and walks the camera through the aisles. The auditor asks to see the returns cage; it is out of frame and the lead says it is empty. She asks him to open the returns log live; it shows seven open returns. The cage is shown: three items without tags. The finding is evidence-based, and the remote method was the reason the auditor used a live log rather than the prepared pack.
When to insist on site
Consider an on-site visit when the area is high risk to safety or product, when earlier findings concerned physical conditions, when the remote evidence is repeatedly incomplete or when something suggests records have been prepared for the audit.
The takeaway
Remote audits are good for records and conversations and weaker for physical reality. Keep control of the sample, prefer live over prepared evidence, protect confidentiality and report the limits.
Last reviewed: 17 October 2026. Facts checked. Opened: web search summaries on FSSC Annex 5 (ICT, version 6), the FSSC full remote audit addendum and the IAF MD 4 reference (secondary). Could not open: MD 4 itself, the FSSC documents in full, or any other scheme's remote audit rules. No limits on remote audit days or percentages are stated.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error