Remote and hybrid fieldwork is a working model for many firms. The audit objectives do not change when the team is not on site: obtain sufficient appropriate evidence, supervise the team, document the work and protect client data. What changes is how each of those is done. This article covers the four areas a firm has to settle, with the procedures where remote work needs the most care. For capacity issues, see building a bench of seasonal and remote audit staff.
Evidence obtained remotely
The audit evidence requirements are the same whatever the location. The relevant question is the reliability of what the team receives, and who controlled it. See audit evidence and information produced by the entity.
Information from the client's systems
Evidence tends to be more reliable when it is obtained directly from independent sources, when the controls over its preparation are effective and when the auditor has direct knowledge of it. Remote work often moves the team from direct system access to client-provided exports. To keep reliability:
- Prefer read-only access to the system, or a screen-share where the auditor drives the queries, over exports the client prepares.
- When an export is needed, document how it was produced: report name, filters, date and time, and who ran it.
- Test completeness and accuracy of exports by agreeing totals to the trial balance and testing a sample against source records.
- Keep the file as received and note any changes.
External confirmations
Confirmations and bank information should be obtained directly from the third party. Electronic confirmation platforms are a category of tool for this purpose. Retain evidence that the request was sent by the auditor and the response came from the confirming party. See audit confirmations under AU-C 505 and SAS 150 external confirmations.
Physical procedures
Inventory observation, fixed asset inspection and walkthroughs are the hardest procedures to move remotely. Where the team cannot attend, options include video-based observation with the auditor directing the camera, third-party attendance by another firm or specialist under supervision, and rescheduling to a date when someone can attend. Each option has limits. A recorded video shows what the camera was pointed at, so the auditor needs control of the direction and the timing. If the evidence is not sufficient and appropriate, a procedure is not complete. Document why the alternative gives adequate evidence, or modify the plan. See inventory observation audit procedures and internal control questionnaire and walkthroughs.
Interviews and inquiry
Inquiry alone does not provide sufficient evidence. Corroborate remote interviews with documents or observation, and write up the memo the same day.
Secure data exchange
The data is the same whether the team is on site or not, and remote work multiplies the paths it travels. The FTC Safeguards Rule, as the FTC describes it, calls for access controls, encryption of customer information on the system and in transit and multi-factor authentication for anyone accessing customer information. The IRS guidance for tax professionals adds that a VPN with multi-factor authentication should be the minimum for remote access to the firm's network, and that the firm should set policies for employees who telecommute, including whether and how they may keep or access customer data at home. See cybersecurity for CPA firms.
A practical set of rules:
- One approved portal for client documents, with individual accounts and multi-factor authentication. No email attachments with confidential data.
- Access by engagement. Team members see only their clients' folders.
- No local copies on personal devices, or encrypted firm-managed devices if copies are needed.
- Secure disposal. Downloads removed when the engagement ends.
- Home network hygiene. Updated devices, protected Wi-Fi, no shared computers.
- Screen privacy. No work in public places where screens can be seen, and no client calls on speakerphone in shared spaces.
- Vendor review for every collaboration, video and storage tool. See ET 1.150 third-party service providers.
Supervision and review
Supervision does not depend on location. The engagement partner and manager are responsible for direction, supervision and review. See SAS 146 quality management at the engagement level and supervision and review of outsourced work under AU-C 220. Remote supervision needs deliberate routines:
- Daily check-in. A short call to confirm work done, issues and next steps.
- Shared tracker. Procedures, status, owner and reviewer visible to everyone.
- Review in the workpaper platform with notes in the file, so review evidence is dated and retained.
- Escalation rules. Staff raise issues in writing the same day.
- Onboarding for new staff. Remote work makes it harder to learn by watching, so provide a structured plan. See staff training plans.
- Planned in-person time for planning, risk assessment brainstorming, key client meetings and close-out. See fraud brainstorming session documentation.
Documentation
Document the following in the file:
- The decision to work remotely, and which procedures were done on site or by alternative means.
- How each remotely obtained piece of evidence was received, from whom and when.
- How exports and reports were tested for completeness and accuracy.
- The alternative procedures for physical observation and the reasoning.
- Supervision and review evidence.
- Any limitations in the engagement and their effect on the conclusions.
See how to document audit procedures.
Client communication
Tell clients before the engagement what the remote model requires of them: a portal account, named contacts for each area, an agreed response time and availability for screen-sharing sessions. Include it in the engagement letter and the PBC list. See PBC list.
Risks that grow in remote work
- Fraud risk factors can be harder to see without on-site presence, so the team should consider more unpredictable procedures.
- Management override is not reduced by distance. See management override of controls.
- Team members working alone may under-escalate.
- Remote evidence is easier to alter in transit, so source and chain matter.
FAQ
Can inventory be observed remotely?
The auditor must still obtain sufficient appropriate evidence. Video observation under the auditor's control or third-party attendance may be alternatives, and they must be documented.
Is a VPN enough?
The IRS says a VPN with multi-factor authentication should be minimum standards for remote access. The firm's plan sets the rest.
Does supervision change in a remote model?
The responsibility does not. The routines do.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
- IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf
- IRS, Publication 5708, Creating a Written Information Security Plan: https://www.irs.gov/pub/irs-pdf/p5708.pdf
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error