Much ink has been spilled since the onset of the pandemic on the feasibility, pros, and cons of conducting remote court hearings, depositions, witness interviews, and deal closings. But what about compliance audits? Is it possible to conduct an effective compliance audit by video? And if so, what are the pros and cons? Keep reading for some practical tips.
What is a compliance audit?
A compliance audit is a formal review of an organization's compliance with particular laws, regulations, or policies. US enforcement authorities recently have taken increasing interest in compliance audits as a way to manage corruption risks associated with third parties and often will ask companies whether they not only include audit rights in contracts with third parties but also if they exercise any such rights. Audits typically include some combination of an examination of a third-party's books and records, testing of selected transactions, interviews of relevant personnel, and a comparison of independent sources of information.
What are the pros and cons of conducting a compliance audit remotely?
Remote or "desktop" auditing is nothing new. Auditors in a variety of fields have long conducted desktop audits to collect and verify information. But we unsurprisingly saw an uptick in their use during the COVID-19 pandemic.
As the last few years have shown, much of what previously could have been accomplished easily only in person now can be accomplished remotely. Documents can be shared on a screen in real time; interviews can take place by videoconference; facilities can be toured through portable devices (such as smart phones, iPads, and even drones). Virtual audits have unique advantages too: Companies can avoid travel costs, and more people can participate in or observe the audit process, from the comfort of their own desk chairs.
But conducting an audit from a desk has limitations. Remote audits allow for only limited visibility of facilities, operations, personnel, and documents. You can't see what is not on the screen. Audit subjects thus might find it easier to be evasive or conceal information when being audited from afar. Audit subjects also may be reluctant to share financial or other sensitive information by videoconference, and data privacy issues may prevent you from even requesting certain information in the first place.
These limitations, though, need not be a dealbreaker. With the right preparation and expectations, remote compliance audits can be effective tool for managing third-party anti-corruption risk, pandemic or not.
Here are some practical tips for remote anti-corruption compliance audits.
- Ensure that your company and your audit subject have access to the appropriate technological tools for secure videoconferencing, document sharing, or other means of exchanging information electronically.
- Do a test run in advance to better ensure the actual audit runs smoothly.
- Do your homework on the audit subject and relevant risk areas ahead of time, so you can focus in on them during the remote audit (especially if you have only limited time reserved for live interaction over video)
- Plan ahead to make sure that the documents, systems, people, and/or facilities you want to see are available.
- Anticipate potential restrictions on the exchange of information, such as data privacy concerns about cross-border information transfers.
- Communicate the expectation that the audit subject will provide complete, truthful, and accurate information.
- If feasible, maintain some element of surprise (such as a question or request not shared in advance) to reduce the risk of any wrongdoers covering their tracks.
- Follow up as needed, just as you would after conducting an in-person audit.
- Consider using a form certification in which you would ask the audit subject to confirm in writing at the conclusion of the audit that the third party has provided true and accurate information to the best of its ability. If you are going to use such a certification, inform that subject at the outset that this will be part of the process so there are no surprises.
- Be prepared to educate any regulators expecting in-person audits why you are conducting virtual audits instead and how the virtual audit process does and does not replicate in-person audits.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.