Remote Audits

Earlier this week, I received an update from the Certification Body that I contract for that they had put into place the requirements defined for the management of extraordinary events or circumstances which includes the use of remote auditing methods.

They are promoting that remote audits are to be the first option. For certification auditors we have to complete an assessment to demonstrate competency in using the tools for remote audits.  These tools could range from:

• The use of Zoom or any video type of call where you can interview, share the screen and do a walkaround
• Remote access of documents and records either by access to Dropbox or Google Docs or they could be simply emailed to you

I’m thinking ahead to the audit that I have scheduled shortly and I will be conducting this remotely.  It’s for a company that is located in an industrial estate with only about 5 staff members, they have an office and a warehouse out the back.  I normally visit the client of course and I spend some time talking to the Director, the consultant and possibly a couple of the staff members.  I do this in the office and in the warehouse, in the warehouse I have a walkaround and ask questions about the processes followed.  This audit is conducted against ISO 9001 – so a quality management systems audit.

So, what I’m thinking I will do is:

Starting at the planning stage, I will update the Audit Plan, so it now reflects the plan and timetable for conducting the audit remotely.  The Plan will need a review to ensure that it reflects the process I am following now that I’m doing it remotely.  There might not need to be that many changes, however I definitely think the Plan should be reviewed.

I will then contact the client and discuss the change in the Audit Plan and the method being used.  Once we’re on the same page I’ll email through the updated Audit Plan.  It’s really important to stay in contact with the auditee and communicate any changes along the way.  Seeing this will be the first time the audit is conducted remotely it’s important for both parties to understand the new plan and even what challenges there may be. 

I am at an advantage as I have been auditing this client for quite a few years so I am familiar with their system and how they control their documents and records.  So, what I’m thinking I will do is email through a Zoom meeting link to the Director and on the day of the audit we will conduct our Opening Meeting via a Zoom call. 

During the Opening Meeting I will confirm the plan for the audit and make any necessary adjustments based on feedback received – this is just normal practice anyway.  Straight after the Opening Meeting, remaining on Zoom, I will follow up what actions they have taken for the previous nonconformances that I raised. 

The Director will no doubt explain to me verbally what they have done, so I will take notes during this (again as I would normally do).  I would get to a point where I would like to see some evidence of these actions taken so the Director could then share his screen with me and show me the records or documents to support what he has verbally told me. 

I have just realised that I know this company does keep some manual or hard copy records so this might be a challenge – but in saying that, I could still request a sample of what I need and they can take a photo or scan these in and email to me or even again share them on their screen through our zoom call – which is probably the better option actually for information security reasons.

The rest of the audit within the office could be conducted exactly the same way with the different auditees.  The challenge will be the audit in the warehouse, but what I’m thinking is that I could still use Zoom but the client could link to Zoom by their mobile or tablet and we could ‘go for a walk’ in the warehouse?  They could show me around, I could ask questions and they could take me there!  I actually can’t wait to give this a go.  I’m sure there will be challenges but I’m sure we’ll have lots of laughs along the way too – which I do like during an audit!

Speaking of challenges it is important to always consider when conducting an audit remotely whether or how you can still achieve the objective of the audit by conducting it remotely.  So, this means can we determine whether the system is conforming to the criteria by NOT being on-site and conducting the audit remotely?  It may be easier to achieve this for quality criteria audits, however may be more challenging for OH&S and environmental audits – however this would also depend on the type of activities conducted and the risk of what the activities are.

I did actually do some on-site training a couple of years ago now for a company that was all about drones – not the ones that you buy in hobby stores.  Really big drones!  I’m talking drones that would have trouble fitting into my double garage!  Part of their work was piloting the drones into central Queensland from Brisbane, so hundreds and hundreds of kilometres away and taking video of gas lines and infrastructure for their client.  Their client could then view the videos to assess whether there were any areas that required maintenance or servicing. 

You can conduct remote audits in conjunction with on-site audits too.  So, you could do like a preliminary audit remotely – much like a document review, gap analysis or sometimes called a Stage 1 audit too.  This way you’re getting an idea of what the system says and how it meets (or doesn’t meet) the criteria you are auditing against.  Some organisations conduct audits like this and refer to them as desktop audits – which you may have already heard of.  By doing this first stage remotely you’re getting an idea of what the business says they do against the criteria and you can identify potential gaps in their system.

So, I say potential because if you are doing this remotely you may not have the opportunity to ask further questions.  That’s ok, because essentially you compile a list of areas that you would like clarification on and that you want to follow up further when you are on-site.  I think this is a good process as then you know which of these potential gaps is the highest risk and you can plan your audit with this in mind.  I like to cover the higher risk areas first in an audit while I’m awake and alert!

And finally when you are reporting on your audit findings that were identified during a remote audit it is very important to document in the report which site or sites had their audits conducted remotely.  The Audit Report should reflect exactly what was conducted and where.

It may even be beneficial to record in the audit report the risks around conducting audits remotely and that there may be an element of uncertainty due to this.  This is perfectly ok as remember audit findings are based on sampling only, we don’t audit the entire system.  That’s actually another topic for another time so I’d better stop here before I start rambling about that!

As I said I am really looking forward to conducting my next audit fully remotely and seeing what I can learn from it as well as my audit client.  And of course, ensuring that the audit is still conducted effectively and provides value to the client.

I’d love to hear about your remote auditing and what tools you use, what challenges you face and what you’ve learnt too!

I do hope that this was helpful and if you have any questions about conducting your audits remotely please let me know.  I love talking about audits and anything management system so it’s no trouble at all.

Ok – so stay safe and healthy and Happy Auditing. 

Note – this is an excerpt from the Auditor Training Online Facebook Live, which you can see here