Remote Auditing Best Practices Post-COVID

Remote auditing is now normal, but the standards haven’t changed

The pandemic normalised remote audit procedures across the profession. What started as emergency guidance from regulators in 2020 has become standard practice for multi-location engagements, cross-border groups, and clients with restricted-access facilities. Most non-Big 4 firms now run at least some procedures remotely on every engagement.

But ISA 500 hasn’t been rewritten to accommodate this. The standard still requires the auditor to obtain “sufficient appropriate audit evidence” to draw reasonable conclusions (ISA 500.6). It still defines appropriateness as the measure of quality, meaning relevance and reliability (ISA 500.A5). And it still places the burden on the auditor to evaluate whether the source and nature of the evidence support the assertions being tested.

What changed after COVID isn’t the standard. It’s the professional consensus on what constitutes acceptable evidence when obtained remotely. The IAASB published non-authoritative guidance in 2020 confirming that remote procedures can produce sufficient appropriate evidence if properly designed, executed, and documented. The FRC echoed this position. But neither body lowered the bar. The evidence threshold stayed the same. The delivery mechanism changed.

For your file, this means every remote procedure needs a documented rationale explaining why the remote method produces evidence of equivalent quality to the in-person alternative. “Travel was impractical” is a reason for choosing the method. It’s not evidence that the method works.

When remote procedures produce sufficient appropriate evidence

ISA 500.A31 lists factors affecting the reliability of audit evidence. Evidence is more reliable when obtained from independent sources outside the entity, when generated internally under effective controls, when obtained directly by the auditor, when in documentary form, and when consisting of original documents rather than copies. Remote procedures affect at least two of these factors: the auditor’s direct involvement and the documentary form of the evidence.

A video walkthrough of a production facility, for example, gives you visual evidence of physical assets. But you didn’t physically verify the asset’s location, condition, or serial number yourself. The client’s employee directed the camera. Your ability to control what you see was limited to verbal instruction. ISA 500 doesn’t prohibit this. But it does require you to assess whether this limitation affects the reliability of the evidence for the specific assertion you’re testing.

The practical test is assertion-specific. For existence of inventory, a live video feed with timestamp and GPS metadata may be sufficient if you can see the goods, identify them against the count sheet, and verify the count in real time. For completeness, the same video feed is weaker because you can’t independently choose which areas to inspect. You’re seeing what someone else points at.

Your risk assessment under ISA 315 connects directly to your evidence decisions here. Higher assessed risk of material misstatement for an assertion means you need more persuasive evidence. Remote evidence is inherently less persuasive for assertions where management has both the ability and incentive to direct what you see. If the risk of overstatement of inventory is significant (ISA 315.28), remote observation alone probably won’t cut it. You need a compensating procedure: an independent third-party count, a follow-up visit, or corroborating evidence from alternative sources such as shipping records or supplier confirmations.

Inventory observation by video: what ISA 501 actually permits

ISA 501.4 requires the auditor to attend the physical inventory counting unless impracticable. The standard doesn’t define “impracticable” exhaustively, but ISA 501.A8-A9 acknowledge that circumstances may make attendance impracticable. When it is, ISA 501.12 requires alternative procedures.

Video observation of a physical count is not attendance under ISA 501.4. It’s an alternative procedure under ISA 501.12. This distinction matters for your documentation. If you watched a count by video, your file should not state that you “attended” the count. State that attendance was impracticable (with the reason), that you performed an alternative procedure (video observation), and that you assessed the evidence obtained as sufficient for the assertions tested.

The FRC’s 2022-23 inspection cycle flagged inventory as a recurring finding area for Tier 2 and Tier 3 firms, with weaknesses in the rigour of audit work and challenge of management evidence. Remote inventory observation compounds these risks. If your team watched a video of a count but didn’t verify the count instructions, didn’t select test items independently, and didn’t confirm the camera showed all storage locations, the procedure has form but no substance.

To make video observation defensible, document four things: how you verified the count was conducted according to the client’s instructions, how you selected items for test counts (ideally before the count, communicated separately to the person holding the camera), how you confirmed the video was live and unedited (screen recording with visible timestamp, no cuts), and what you couldn’t verify remotely and how you addressed that gap.

External confirmations and electronic evidence under ISA 505

ISA 505.7 requires the auditor to maintain control over the confirmation process. In a remote audit, this means you send the confirmation request directly to the third party (never through the client), you receive the response directly, and you evaluate the response for indicators of unreliability.

Electronic confirmations have been standard for bank confirmations since well before COVID. Services like Confirmation.com route requests through secure platforms that maintain the auditor’s control. But for non-standard confirmations (trade receivables, legal confirmations, loan balance confirmations), remote auditing has increased the use of email-based confirmations, which introduce specific risks.

An email confirmation from a client’s customer is only as reliable as your ability to verify the email’s authenticity. ISA 505.A16 notes that responses received electronically involve risks to reliability because it may be difficult to establish proof of origin and authority of the respondent. If you send a confirmation to an email address provided by the client, and the response comes back from the same domain, you haven’t independently verified anything. The client could control both ends.

For email confirmations to meet ISA 505 standards in a remote context, verify the email address independently (from the counterparty’s website, a public directory, or prior year correspondence). Send from a firm email address, not through the client’s system. Document the verification step. If the response arrives suspiciously quickly, with round-number balances, or with language that mirrors the client’s records, treat it as an exception under ISA 505.14 and perform alternative procedures.

Scanned documents present a separate evidence quality issue. ISA 500.A12 acknowledges that photocopies and electronic documents may be less reliable than originals. In a remote audit evidence context, you’re routinely working with scanned contracts, photographed invoices, and screen-shared bank statements. Document what you received, in what format, and whether you performed any corroboration (comparing the scanned invoice to the accounting system entry, tracing the bank statement to an independent bank confirmation).

Documenting the remote audit decision under ISA 230

ISA 230.8 requires documentation that enables an experienced auditor with no prior connection to understand the nature, timing, and extent of procedures performed. For remote procedures, this means documenting not just what you did, but why you did it remotely and why the remote approach was sufficient.

Your documentation should cover four elements. First, the reason the procedure was performed remotely rather than in person (client location access restrictions, cost-benefit for a low-risk assertion, cross-border travel constraints). Second, the specific remote method used (live video call, recorded screen share, electronic document portal, email confirmation). Third, your assessment of the evidence quality against the assertion being tested, including any limitations you identified. Fourth, any compensating procedures you performed because the remote evidence was insufficient on its own.

The FRC’s inspection findings consistently flag documentation quality as a weakness across Tier 2 and Tier 3 firms. In a remote audit context, the risk of a documentation deficiency is higher because the procedure itself is less self-explanatory. An in-person inventory count is well understood. A video observation requires explanation: what platform was used, who held the camera, what you could and couldn’t see, how you selected test items, and what you concluded from the observation.

Worked example: Müller Fertigung GmbH

Client profile: Müller Fertigung GmbH is a German precision engineering company with €28M revenue, a single production facility near Stuttgart, and a warehouse in Brno, Czech Republic. The warehouse holds approximately €3.4M in raw materials and finished goods. Travel to Brno for the year-end count would cost approximately €2,800 and require two audit days.

Step 1: Assess whether remote observation is appropriate

The Brno warehouse inventory of €3.4M represents 12% of total assets. Performance materiality is set at €420K. Assessed risk of material misstatement for inventory existence at Brno is moderate (no history of count discrepancies, stable inventory levels, single product line). You determine that the cost and time of travel are disproportionate to the assessed risk, and that a well-designed remote procedure can produce sufficient evidence.

Step 2: Design the video observation procedure

Before the count, you send the engagement team’s test count selections (40 items from the stock listing, 15 items selected from the floor to the listing) to a separate contact at Müller Fertigung’s Brno facility. The count team and the camera operator are different people. You require a live video call on a platform that displays continuous timestamps, with no recording pauses.

Step 3: Execute and evaluate

During the two-hour video session, you observe the count team counting 40 items you selected from the listing. You identify two items with quantity discrepancies (one shortage of 12 units of aluminium bar stock, one excess of 8 units of machined housings). You also select 15 items visible on the warehouse floor and request the count team to count them against the listing. All 15 match.

You note that one storage area (a mezzanine level) was not covered during the video walkthrough. The warehouse supervisor confirms it holds approximately €180K of slow-moving stock. You cannot verify this remotely.

Step 4: Conclude

The video observation, combined with test counts and the compensating procedure for the mezzanine, provides sufficient appropriate evidence for the existence assertion. The two discrepancies (net value: €1,200) are below the clearly trivial threshold and were corrected by management during the count. The condition assertion is supported by the visual evidence of proper storage conditions observed on the video feed.

Practical checklist for your next engagement

1. Before choosing a remote procedure, assess the risk of material misstatement for the specific assertion at the specific location. High risk demands more persuasive evidence, which usually means in-person procedures or well-corroborated compensating evidence.
2. Document the reason for the remote approach separately from the procedure itself. “Why remote” and “what we did” are distinct questions, and ISA 230.8 requires the reviewer to understand both.
3. For video inventory observation, select test items before the count and communicate them independently of the count team. Require a live, unedited session with visible timestamps. Screen-record it.
4. For electronic confirmations, verify the third-party email address independently of the client. Send from a firm address. Document the verification step and any indicators of unreliability.
5. Identify what you couldn’t observe or verify remotely and state it explicitly. Then document the compensating procedure you used to address the gap.
6. Keep a log of all remote sessions (date, platform, participants, duration, what was observed) as supporting documentation under ISA 230.A1.

Common mistakes

• Describing a video observation as “attendance at the physical inventory count” in the working papers. The FRC distinguishes between attendance (ISA 501.4) and alternative procedures (ISA 501.12). Mislabelling the procedure creates a documentation error that could be flagged in an inspection.
• Accepting scanned documents without any corroboration. ISA 500.A12 flags photocopies and electronic copies as potentially less reliable. If the only evidence for a €500K lease contract is a PDF the client emailed you, compare the terms to the accounting entries, confirm the counterparty independently, or obtain the original.
• Failing to document the limitations of a remote procedure. Every remote approach has something it can’t do as well as the in-person equivalent. If you don’t state the limitation and how you addressed it, a reviewer can’t evaluate whether your evidence was sufficient.

Related content

Frequently asked questions

Further reading and source references

• ISA 500, Audit Evidence: paragraphs 6, 7, A5, A12, and A31 on evidence quality, reliability factors, and electronic documents.
• ISA 501, Audit Evidence — Specific Considerations for Selected Items: paragraphs 4, A8-A9, and 12 on inventory attendance and alternative procedures.
• ISA 505, External Confirmations: paragraphs 7, A16, and 14 on auditor control, electronic confirmation risks, and exceptions.
• ISA 230, Audit Documentation: paragraph 8 on documentation enabling reviewer understanding.
• ISA 315 (Revised 2019): paragraph 28 on significant risks and the evidence threshold.
• FRC Audit Quality Inspection Reports 2022–24: recurring findings on inventory observation and documentation quality at Tier 2 and Tier 3 firms.