ISO 19011:2018 - Guidelines for auditing management systems

Annex A

(informative)

Additional guidance for auditors planning and conducting audits

A.16 Auditing virtual activities and locations

Virtual audits are conducted when an organization performs work or provides a service using an on-line environment allowing persons irrespective of physical locations to execute processes (e.g. company intranet, a “computing cloud”). Auditing of a virtual location is sometimes referred to as virtual auditing. Remote audits refer to using technology to gather information, interview an auditee, etc. when “face-to-face” methods are not possible or desired.

A virtual audit follows the standard audit process while using technology to verify objective evidence. The auditee and audit team should ensure appropriate technology requirements for virtual audits which can include:

- ensuring the audit team is using agreed remote access protocols, including requested devices, software, etc.;

- conducting technical checks ahead of the audit to resolve technical issues;

- ensuring contingency plans are available and communicated (e.g. interruption of access, use of alternative technology), including provision for extra audit time if necessary.

Auditor competence should include:

- technical skills to use the appropriate electronic equipment and other technology while auditing;

- experience in facilitating meetings virtually to conduct the audit remotely.

When conducting the opening meeting or auditing virtually, the auditor should consider and the following items:

- risks associated with virtual or remote audits;

- using floor plans/diagrams of remote locations for reference or mapping of electronic information;

- facilitating for the prevention of background noise disruptions and interruptions;

- asking for permission in advance to take screen shot copies of documents or any kind of recordings, and considering confidentiality and security matters;

- ensuring confidentiality and privacy during audit breaks e.g. by muting microphones, pausing cameras.