How audits go virtual, auditors tell

Our auditors typically expend significant time and resources to travel back-to-back to often remote places to conduct onsite audits. Since the COVID-19 outbreak, we have started using a risk-based approach to decide the replacement of onsite evaluation with a remote audit, subject to a country’s risk classification based on its national travel advisory. Auditors will also determine the eligibility for remote audits depending on relevant risk factors for Chain of Custody or forest/farm evaluations.

The risk-based approach is not something new to NEPCon as our specialists have been using it for over a decade to analyse the legality of sourcing timber and other forest impact commodities from countries across the globe.

An obvious choice but varying adaptation

Over in China, a number of certificate holders we work with accepted this flexible audit process. “Some felt the remote audit process was better and safer. In China, if auditors were to travel to a different city or an area, certificate holders need to file several papers to local government such as a commitment letter confirming the auditor from a certification body is healthy and free from the coronavirus. This can be burdening for a certificate holder,” says Huang Rui, NEPCon Forest Certification Specialist based in NEPCon’s Beijing office.

Although remote audits conducted virtually seem like the most obvious choice due to a sudden worldwide pandemic, it can be an awkward experience for some. “Conducting a remote audit can be intimidating for auditees in cases when we have yet to meet physically,” says NEPCon Regional Manager for Africa Sandra Razanamandranto.

Restricted sample selection and space observation

An audit involves a mix of techniques to gather and evaluate evidence, from visual observation to examination of records, and employee interviews.

Huang raises some challenges in interviewing relevant personnel during a remote audit. “Usually, we need to interview key managers and workers (separate from one another) to cross-check the implementation procedures. However, for remote audits, the workers are interviewed while being observed by the management.”

“Besides that, it is also tough for an auditor to randomly sample interviews because there is a risk that the organisation may select someone familiar with the process for the interview. There is a threat to the certificate impartiality,” he adds. In addition, non-verbal communication that can help detect inconsistencies, if any, is difficult to capture during a remote audit.

Huang lists other challenges including inventory checking and warehouse inspection, as well as health and safety policy implementation. “During an onsite audit, it is important to cross-check the current stockpile in the warehouse with the quantity (recorded in logbooks). With remote audits, it is hard for an auditor to check the stockpile. Meanwhile, for health and safety guidelines, we also cannot ascertain it is implemented,” particularly when most operations may be shut down.

There are limitations, such as fully assessing Health and Safety conformance, especially in countries lacking Occupational Health and Safety (OHAS) regulation as auditors may not notice subtle issues during a video tour. “However, this is less risky in regions where OHAS regulations are in place and most clients are subject to OHAS audits outside of the Forest Stewardship Council™ (FSC™) process. Records related to that regulated process can help auditors assess conformance when we conduct audits remotely,” says Janice O’Brien, NEPCon US/Canada Client Service Manager. 

When documents are reviewed virtually…

Annabelle Calicdan, a freelance auditor-cum-trainer based in the Philippines, echoes similar views about challenges in a remote, desk audit. “In my view, a remote audit for group certification is quite challenging when compared to a single farm certificate. There are documents that we cannot gather such as smallholder workers’ wages and farm records,” she says.

“Some clients still prefer to have it (audit) face to face owing to the fact that there is a bulk of documents from clients to be sent to an auditor for review. This poses a dilemma for auditors because it is difficult to determine the time needed to complete the audit process as opposed to doing it face to face.”

Technology comes with both solutions and challenges

Remote audits depend on the availability of technology to support interactive conversation and being able to review documents and data. Skype, WhatsApp/WeChat or other virtual meeting applications are normally used. Hence, having a stable Internet connection and a reliable programme, particularly technology that allows face-to-face interaction are helpful.

Sandra has first-hand experience dealing with a variety of challenges like Internet connectivity, especially for clients in more remote parts of Africa. Meanwhile, for Annabelle, she encountered a common problem faced by most Internet users – a technical glitch with Skype during her scheduled evaluation with a client. “As a result, we could not hold a group conference,” she says. With some adjustments, the call went ahead after the initial hiccup.

Things are different for Janice. She shares her positive experience with technology. “The use of different technology is definitely helpful, and video conferencing is great, as the face to face component of an audit is important. Body language is always useful in auditing, for both the auditor and certificate holder.”  

Thinking on their feet for solutions

In cases when remote audits have a high level of risk, Huang says he will complete a shorter on-site visit when the situation allows.

“I am still exploring solutions to staff interview. It can be done by connecting individually with workers via video chatting app. For inventory checking and warehouse inspection, as well as health and safety policy implementation, this can be done via live video chat.”

In Annabelle’s view, audits under the certification scheme should consider having options for remote audits as a permanent approach. “However, a risk assessment tool should be designed. This tool should be answered by the client for the certification body to determine their risk classification. An audit report template and checklist should also be designed for this type of audit.”

The future for remote audits  

Partial remote audits can provide a good compromise. By initiating some of the audits remotely, auditors are better prepared for the site visit with a list of questions from document review and they are able to target areas to inspect and people to interview in person. All the initial time and effort on remote work can lead to more efficient and effective use of time spent in the field and support best practices of limiting close personal contact as travel restrictions lift.

“It is obvious that an onsite audit cannot be fully replaced by a remote audit in all situations. But with a well thought out risk-based approach to auditing, there is a huge opportunity to do remote or partial remote audits, where we conduct our audits differently than before. We can do a lot of the audit remotely using technology, therefore limiting the scope of the onsite work to only that which does pose challenges to the credibility of the overall audit evaluation; such as OHAS conformance and sometimes confidential interviews with the production staff,” says Janice.

These challenging times dealing with COVID-19 alternatives have demonstrated the importance of adapting and keeping pace with future risks. Adopting remote audits allows ongoing certification during unusual times. Although technology enables us to continue working while minimising undesired risks, experiences so far show auditors must have quick thinking skills during a spur of the moment interactions to solve new issues and unforeseeable circumstances.

The COVID-19 pandemic has forced quick solutions through remote auditing, but it has also given us the opportunity to test this model, learn its quirks, and work on a more robust remote audit approach for the future.