uea13-21

DOWNPASS-Standard Annex 4 – Remote audit implementation template- preliminary version Introduction:
Remote auditing (audits from a distance) is one of the audit methods described inISO 19011:2018, Annex A1. The advantage of remote auditing lies in its potential toachieve audit objectives through maximum flexibility. To take advantage of this audit
method, all interested parties need to be aware of their role in the process, what their
input is, what the expected output is, and which risks and opportunities need to beconsidered in order to achieve the audit objectives.
There are a variety of reasons why an auditor may not be present for an on-site audit,
for example, due to security restrictions (access restrictions), travel restrictions,pandemics, etc.
New information and communication technologies (ICT) have made remote auditing
possible. As access to ICT has improved, remote auditing is becoming morecommon. This enables the auditor to communicate with people around the world andaccess a wide range of information and data.
These technologies are changing the way work is done. ICT opens up the possibilityof auditing sites and people remotely, reducing distances, travel times and costs,
reducing the environmental impact associated with audit travel, facilitating adaptation
to customer needs, and improving the quality of products.
ICT can help increase the scope or quality of sampling in the audit process if properly
prepared, validated and used. This is the case, for example, when video cameras,
smartphones, tablets, drones and satellite images can be used to verify physicalconditions such as production processes or forestry and agricultural areas.
The use of ICT also enables the inclusion of expertise in an audit that would
otherwise not be possible due to financial or logistical constraints. For example, theparticipation of a technical expert for the analysis of a specific project can bescheduled for short periods of time (for example, two hours). With ICT available, thetechnical expert can analyze the process remotely, reducing time and costs andimproving the quality of the results.
On the other hand, the limitations and risks in meeting audit objectives must also beconsidered when using ICT. These include questions of information security, dataprotection, confidentiality, and the truth and quality of the objective evidencecollected.
For example, questions may arise regarding video quality, the stability of the network
connection, the auditors' expertise in using ICT, the quality of the images, etc.
To make the decision to use ICT in the audit process, auditors must work with theaudit team and the client to identify the risks and opportunities associated with theuse of ICT and define decision criteria to approve the use of ICT for a remote audit.
1V1.0 (02.02.2021)

Erstellt: yn

Freigabe: HEuea13-21General recommendations for remote audits:- Audit program
1. Basic considerations
ICT may only be used for remote auditing if the right conditions are met. This meansthat the technology must be available and both the auditor and the auditee must be
familiar with the use of the technology. If these prerequisites are not present, aremote audit may not be performed. In order to use the technology in the audit
process, there must be a consistently high quality online connection. Weakbandwidth or hardware will make the process inefficient. An audit process that isalready underway must be stopped if such circumstances exist and cannot be carriedout until the technical requirements have been adjusted accordingly.
2. Confidentiality, security and data protection (CSDP)
Crucial to the use of ICT are questions of confidentiality, security and data protection.
The auditor and the company to be audited must take into account the laws andregulations and possibly make additional agreements to take account of theconfidentiality, security and data protection requirements. The data protection officer(DPO) on both sides should be involved in assessing these questions. To prepare forthe use of ICT, both customer requirements and auditor requirements forconfidentiality, security and data protection should be addressed and reviewed. ICT
may only be used if all measures have been taken and both parties confirm that theconfidentiality, security and data protection requirements are met, and both parties
agree to the use of ICT. Evidence of this agreement shall be provided in writing andattached to the audit documentation. This evidence must also be attached to theaudit report.
The audit team must be given access to both documented information and to thebusiness premises, farms, warehouses, rearing areas, barns, etc. when conducting a
remote audit. These records (documented information) should be shared in a securesystem, such as a cloud or virtual private network or other file sharing system. The
data must be stored securely. Auditors should not take screenshots of audited
persons as audit evidence; screenshots of persons should be made unrecognisableor removed. Screenshots of documents or records or other evidence shall be kept
securely for documentation purposes.
3. Risk assessment
The risks taken to achieve the audit objectives must be analyzed, identified andevaluated by the auditor.

- Feasibility and risk analysis for remote audits:
1. Confidentiality, security and data protection
All parties must ensure that there is agreement between the auditor
and the auditee on the questions of confidentiality, security and dataprotection. Precautions must be taken to ensure compliance with thesecriteria.
2. Use of ICT
2V1.0 (02.02.2021)

Erstellt: ynFreigabe: HEuea13-21

There is a stable connection with good online connection quality.
ICT enables access to relevant documented information including
software, databases, records.
It is possible to authenticate / identify the interviewees, preferably witha picture.
If observation of facilities, processes, activities, etc. is relevant toachieving audit objectives, also review them via video.
Changes to the process from the past (for example, application of aCorrective Action Plan) can be reviewed via video.
3. People in the organization
It is possible to access and question the people relevant to the quality
management system.
4. Operation
If the company is not in regular operation due to emergency situations,the processes / activities checked by means of the remote audit are
representative and allow the audit objectives to be met.
5. Complexity of the company and the type of audit
In case of complex company structures, processes or products andservices, the auditor must carefully check whether the remote audit tool
is suitable for complete evaluation of the company and its compliancewith all requirements of the DOWNPASS-Standard.
6. Conclusions
If the audit objectives can be achieved with a remote audit: Proceed with the remote audit.
If the audit objectives can be partially achieved with a remote audit: A remote audit can be partially carried out and later
supplemented by an on-site audit.
If the audit objectives cannot be achieved with a remote audit:
 An on-site audit must be performed instead of the remote audit.

- Criteria for assessing the quality of the remote audit:
All information needed to gain an understanding of the company, its processes andoperations should be provided to the auditor in writing prior to the use of ICT so thatthe auditor can determine whether such an audit is appropriate to achieve the audit
objectives. The auditor must be provided with all information regarding the size of thecompany, the operational procedures and processes. The auditor's questions must
be answered. If both parties decide in favor of a remote audit and the use of ICT, theauditor must be granted remote access to the operational (production) facilities,processes and documents so that the audit objectives can be achieved. The persons
to be audited must also be identified and it must be ensured that these persons areavailable during the remote audit. Before conducting the remote audit, it is advisable
to conduct a test on the use of ICT to confirm that a stable Internet connection exists
3V1.0 (02.02.2021)

Erstellt: yn

Freigabe: HEuea13-21

and that the employees in the company have been briefed on what technology isused and how it is used.

- Audit planning
The auditor has the option of conducting opening and closing meetings with people
at various locations via remote audit. Furthermore, he has the possibility to organize
interim meetings with the audit team via telephone call, video conference or webmeeting.
The review of operational processes, operating equipment and production processes
must be carried out by video images in real time, or alternatively by using drones,
mobile or fixed video cameras. This must be taken into account during audit planning.

- Audit implementation
When conducting the audit, an opening meeting must be held. During this meeting,the availability and feasibility of the use of ICT should be confirmed. Measures toensure confidentiality and security should also be presented and agreed upon. If theauditor intends to take screen shots, copies of documents, and other types ofrecordings, permission should be requested, either at the opening meeting or when
ICT is used. When using ICT to interview people, the audit team should record thename and functions of the people interviewed and inform the people interviewed
what information will be retained by the auditor. When conducting interviews
remotely, the auditor must verify factual assertions using other evidence. These must
be requested and analyzed by the auditor. If sent by email, the auditor should ensure
the necessary confidentiality for these documents.
While conducting the audit, care should be taken to ensure that communication is not
disturbed by noise. When auditing remotely, the auditor should ensure that there are
no interruptions or disruptions. Similarly, if there are breaks. During breaks, thesound must be muted and the image turned off to ensure privacy.
When using video to view live online images from such remote locations, it isimportant that the enterprise demonstrate the veracity of the images. For example,
the date of a current day's newspaper can be superimposed on the transmission oflive images to demonstrate that these images are actually being taken on that date.
When viewing images of a (production) facility, they can also be compared to floor
plans. When viewing images of a geographical location, these can be compared withavailable satellite images or information from geographical information systems.
All evidence, as well as the manner in which evidence is preserved, must berecorded.
In a remote audit, it is important to schedule small breaks, just as they are usuallyscheduled in an on-site audit. The auditors and the employees of the company being
audited must be given breaks.
An auditor may interrupt the audit, for example, to read current information or analyze
information provided. After such a short interruption, the audit can continue. Bothsides must ensure that all relevant contacts are available during the estimated audit
time and that the operating sites are accessible.

4V1.0 (02.02.2021)

Erstellt: yn

Freigabe: HEuea13-21- Audit report
The audit report should describe the extent to which ICT has been used and theeffectiveness of its use in achieving the audit objectives. The report should identify
the processes that could not be audited but must be audited on site. This is important
for the decision-making process and subsequent audits. The audit team's feedbackon the use of ICT must be given to the audit manager, who uses it to update the risks
and opportunities previously identified. The audit program manager must decide
whether the audit objectives could be achieved with the remote audit, whether followup work is necessary, or whether the remote audit must be supplemented by an onsite audit- Audit validity
The validity of a remote audit is one year. A remote audit must be followed by an onsite audit.

5V1.0 (02.02.2021)

Erstellt: ynFreigabe: HEuea13-21

Annex: Example of identification of Risks and Opportunities for using remote audit techniques1

Information andCommunication Technology(ICT)

Potential Use

Opportunities

Security and confidentiality violations;Differences in time zones;
Authentication of the person;
Low Quality of communication;
The possibility to observe the organization in a moreautonomous and free way is weakened as the auditor
does not command the camera
The possibility to observe reactions from several
auditess to communication may be weaker

Interview with relevant personnel working remotely, e.g.
home office, project teams in design and development;
Opening closing meeting in multisite audits;
Remote site/activities where physical observation is notcritical;Travel time/costs reduction and associatedenvironmental impacts;
Greater geographical range

Documentary review withauditee participation

Security and confidentiality violations;
Potential difficulty in responding to documentation
requests;
Increased time required (potentially time-consumingprocess);
Potential data manipulation;
Interaction with auditees may be weakened
Diminished quality of information collected

Document reviews where site travel is not feasible, e.g.
first stage audits where site visit is not critical to theachievement of objectives and time/travel constraints
exist;
Multi-site - good for remote sites where site visit can beskipped or where annual visits within the audit program
are not necessary, but some follow up is needed;
Travel time/costs reduction and associatedenvironmental impacts

Filling out checklists andquestionnaires

Guarantee of authenticity;
Need to pre-develop checklist and possibly prepare
respondent to answer them, which increases costs

Better knowledge of the organization, applicable at
preparation stage of the audit;
Allows to prepare audit work, which needs to be verified
during the audit by gathering other evidence;
Allows the organization to prepare to the onsite visit

Conducting Interviews
Guided site tours
Video call (synchronous)(e.g.: Skype, WebEx, ZOOM,Hangouts)

Surveys, Applications

Risks1© ISO & IAF 2020 – All rights reserved
www.iaf.nu; https://committee.iso.org/home/tc176/iso-9001-auditing-practices-group.html
Editon1 2020-04-16

11 /12Information andCommunication Technology(ICT)Document and data review(asynchronous)(e.g.: web document review)

Potential Use

Viewing records,
procedures, workflows,
monitors, etc.

Risks

Opportunities

Security and confidentiality;
Procedural difficulty in document viewing (e.g. accessing
remotely and navigating in the organization website);
Increased time required (potentially time consumingprocess);
Potential data manipulation;
Lack of interaction with the auditees does not allowclarification of issues;
Transparency - Auditee loses perception of what is being
audited and the sample

Eases organization and allows for a more flexible use oftime by the audit team;
Allows for better, more independent from the auditee
and deeper exploration of information;
Possibility of integrating expertise that would not be able
to travel to the site;
Provides good basis for understanding the organization’s
QMS, and potentially provides audit trails that the auditor
may utilize during interviews.

Risks inherent in the use and presence of equipment;
e.g. drone drop, use of equipment, unfavourable weatherconditions;
Quality of image;
Full appreciation of the site, equipment and conditions
Veracity of the data

Easy monitoring of high risk tasks;
Increased sampling;
Ideal for auditing activities where the safety
requirements do not allow the presence of the audit
team, or to observe places and facilities where the ratio
travel time versus audit time is high;Good for complementing field visits in outdoor activities (e.g. forest and agricultural sites, mining)

Security and confidentiality;
Quality of image;
Full appreciation of the site, equipment and conditions
Veracity of the data

Higher profitability (possibility of selecting only themoments of interest of the video);
Possibility of observing places, hard to reach facilities
and improving sampling
If the electronic record contains sensitive data that
CSDP criteria considers not elegible for remote auditing,the auditor should consider reassigning that record
review for onsite audit.

Monitoring of remote or highrisk work;
Guided site visit;
Video (synchronous)(e.g.: drone, live stream)

Ability to view high risk
processes or operations
Witnessing running
processesVideo (asynchronous)(e.g.: surveillance camera,video recordings purposely
taken for audit)

Monitoring of activities thatare not ongoing at the timeof the audit;
Process videos;Call center voice recordings.
Recorded training webinars© ISO & IAF 2020 – All rights reserved
www.iaf.nu; https://committee.iso.org/home/tc176/iso-9001-auditing-practices-group.html
Editon1 2020-04-16

12 /12