By Huzeifa Unwala, Senior Partner, JHS & Associates LLP
During the Locked Down when everyone is working from home, how the consulting and auditing firms can do auditing from home (AFH)
- A fast-changing world
The onset of COVID 19 and consequent social distancing practices has compelled the most ardent on-site auditors to re-think their auditing plans. Safety of clients, teams and public at large are forcing the internal audit fraternity to re-calibrate their on-site auditing routines especially services that require physical contacts such as verification of inventory, assets, cash counts and the year-end cut off controls that need to be verified. Clients and auditors are not yet fully geared up to meet this fast-changing situation on account of the health pandemic and the related social distancing practices across 150+ countries that seems to be locking up virtually everything. Work from home (WFH) has emerged as the saving grace perhaps a more efficient way of working for internal auditors.
WFH for auditors largely remains untested as it is in uncharted waters at the moment in India. However, we can take inspiration from the new Standard on Internal Audit (SIA) 360 – Communication With Management issued by the ICAI to understand what may be required to establish a set of formal communication protocols with the management.
- Scope & Requirements of SIA 360
SIA 360 applies to all audit assignments and internal audit activities. The internal auditor’s communication to report his findings in the form of a written report or formal presentation is the subject matter of another Standard i.e., SIA 370, \”Reporting Results\”.
\”Communication\” refers to any information exchange between the Internal Auditor and management, either through written or verbal means. A \”free flow of information\” and \”continuous dialogue\” with management, at various stages of the internal audit process, is essential to the achievement of internal audit objectives.
Key Elements of the Standard:–
- Written Communication Process
IA should establish a written communication process and protocol with the management
- Periodicity & Timelines
The protocol should be clear and define periodicity, timelines
- Modes & Channels
The protocol should outline various modes and channels of communication. Mode of communication would include, e.g., verbal, written, images, videos, etc. Channels would include, e.g., phone, conference calls, file transfer protocols, e-mail, scanned images, hard copy, etc.
To conform to audit procedures with this SIA, the list of documents required is as follows:
- As a part of the Internal Audit Manual, Written Communication process and protocol.
- Cross-reference to the Internal Audit Program, where appropriate, written details of the essential exchange of information, as required by other SIAs.
SIA 360 is applicable for internal audits beginning on or after a date to be notified by the ICAI.
- Customising communication protocols for implementing Auditing from home
Building on the requirements of SIA it would be advisable for the IA function to develop an Auditing from Home (AFH) charter document for the internal audit staff and obtain a sign off on the said charter from the Audit Sponsor/ Audit Committee.
The AFH charter should consider clauses on the following matters: –
- Authentication of users for the purpose of remote access to systems
- File exchange protocols and backing up of local data
- Updating of endpoint security and anti-virus definitions
- Encryption and confidentiality of data
- Acceptable use of desktops, devices and printers at home and use of acceptable collaborative tools
- Use of secured internet/ broadband connectivity
- Use of work/ employee monitoring tools and reporting
Further, the Chief of Internal Audit or IA Engagement Partner may identify the resources which could be most eligible for AFH scenarios for example where resources are involved in IA coordination work, writing reports, remote data analytics, etc. could be most eligible candidates for moving into AFH stack on priority. Other considerations include providing flexible time schedules to employees who Audit from home; however, minimum working hours may be outlined so that productivity does not suffer, job termination clauses in case of non-responsiveness of employees to repeated calls/ queries that go unaddressed, etc. may be included in the AFH Charter.
Crisis gives us lessons and adapting to AFH is one of the key lessons for auditors that are emerging from the social distancing practice, welcome to the beginning of a fresh new way of Auditing that is AFH – Auditing from home.
