F E AT U R E

AUDITING

16 QP September 2020 ❘ qualityprogress.com

 The COVID-19
crisis has brought
remote auditing to
the forefront.

There are definite

pros and cons to
remoting auditing
that auditors
must be aware of
before deciding
which route to
take.

A remote audit
requires planning,
time, resources
and implementa-
tion of auditing
best practices,
just as if conduct-
ing an on-site
audit.

Taking adequate
time and follow-
ing best practices
fatido/matejmo via Getty Images

may be even
more important
when conduct-
ing a remote
audit. The author
offers eight best
practices to
incorporate into
remote activities.

Advice on getting the most out of remote

auditing to minimize risk and manage
suppliers | by Lance B. Coleman Sr.

qualityprogress.com ❘ September 2020 QP 17

F E AT U R E
AUDITING

The ongoing COVID-19 crisis has emphasized the

importance of maintaining a strong supply chain.
An important aspect of supply chain management
is the supplier audit process. With several travel
restrictions and social distancing requirements
in place, many audits are being converted from
on-site visits to remote interactions.
However, without the ability to witness opera-
tions, tour facilities and interview operators at their
respective workstations, how can a truly thorough
audit be conducted? And how can a truly robust
remote audit be conducted?

What a remote audit is and isn’t

ISO 19011:2018—Guidelines for auditing manage-
ment systems defines an audit as a “systematic,
independent and documented process for obtain-
ing objective evidence and evaluating it objectively
to determine the extent to which the audit criteria
are fulfilled.”1
There are many different terms used to describe
various types of remote auditing: e-auditing,
virtual auditing, desk auditing and document audit-
ing are some of the most common. Sometimes,
the terms are used interchangeably and sometimes
with differing definitions. Often, document or desk
audits are considered the document review portion
of a larger audit, completed prior to the opening
meeting, whether onsite or virtual.
For the purposes of this article, remote audit-
ing applies to all of these terms and is defined as To successfully prepare for audits, the
“when audit activities are conducted by the audit lead auditor must identify any risks to a
team, either simultaneously or while engaged with successful audit, and plan and implement
the auditee, when not physically on the audit site.” mitigations for them.
These activities may include reviewing documented
information, conducting interviews, observing via
video feeds, analyzing data and trends, and rein- There is a place for supplier self-assessments
specting product via a video of a reinspection. but not in lieu of an independent audit.
Before considering what a robust remote audit + Filling out any other form. No other form com-
entails, think about what a remote audit isn’t: pleted by a supplier—whether it is some titled
+ Completing a self-assessment checklist. assessment, audit or review, or pertains to the
That includes one aligned with the clauses QMS or aspects of manufacturing operations—
of an applicable International Organization should be considered an audit.
for Standardization (ISO) quality manage- + Reviewing the quality manual and ISO certif-
ment system (QMS) standard. An audit is a icate. Whereas this is a good thing to do and
process, and a process means there is work should be part of an audit, in and of itself, this
being done by the process owner. In other level of assessment does not constitute an audit.
words, an auditor can’t pass off his or her + Skipping an on-site visit because of time or
work on the supplier to assess its own QMS. money factors. Conducting a remote audit should

18 QP September 2020 ❘ qualityprogress.com

 be a conscious, planned decision balancing risks
and resources. It should not be an ad hoc decision
based on the easiest path during a time of duress.
That is why it is critical to have an established
decision-making framework that determines when
a remote audit might be appropriate, as part of
the supplier management process. to Managing Organizational Risk Using the Supplier
Does this scenario sound familiar? Two auditors
are assigned to perform a two-day on-site audit of
a supplier. Business necessities require the audit to
be converted from an on-site visit to a desk audit.
Suddenly, only one auditor is needed, and the audit
is expected to be completed in half of a day.
iStock.com/MediaProduction
Granted, some time can be saved because
remote audits don’t require presence on the shop
floor, but the overall breadth of the audit and effort
required to conduct remains the same. Where
does this disconnect come from? In too many
cases, quite frankly, remote audits aren’t taken
as seriously as on-site audits. This is not always
the case, but often enough.
“Something to be wary of is that there can
sometimes be a tendency to make desk audits a
‘checkbox’ exercise if it is decided that there will
not be an accompanying on-site audit,” according
Audit Program. “This is a big mistake! A properly
conducted desk audit can take hours to complete—
minimally between four and eight hours.”2
A remote audit requires planning, time,
resources and implementation of auditing best
practices, just as if conducting an on-site audit.
In fact, taking adequate time and following best
practices are even more important when con-
ducting a remote audit because you lack the
benefit (in most cases, at least) of being able
to witness operations occurring on the floor and
comparing them with documented expectations.
qualityprogress.com ❘ September 2020 QP 19
 F E AT U R E
AUDITING
Pros and cons of remote auditing
There are many reasons, even during normal
times, to conduct remote audits.
+ They are less expensive, require fewer resources
and can be less intrusive on the auditee.
+ They allow for multitasking. Auditors can work
on the audit for part of the day and other tasks
during the rest. Auditors also can work on more
than one audit at a time.
+ There is flexibility in being able to conduct an
audit over a more extended period of time,
when necessary.
When done properly and under the correct
circumstances, remote auditing can meet ISO and
regulatory requirements for supplier oversight.
It is the cons or risks associated with remote
auditing that sometimes give pause. A deeper
dive into remote auditing process risks is needed,
therefore, because these must be mitigated to
ensure a successful audit.
The following list is meant to be comprehensive
but certainly not exhaustive. The key takeaway?
To successfully prepare for audits, the lead auditor
must identify any risks to a successful audit (such
as these concerns), and plan and implement miti-
gations for them. These could include:
FIGURE 1
Virtual audit process
Process inputs Virtual audit
+ Auditor
+ Auditee
+ Planning
+ Meetings
+ Digital integrity review
+ Interviews
+ Observations
+ Technology
+ External standards
+ Historical record review
20 QP September 2020 ❘ qualityprogress.com
+ Difficulty seeing operations in action.
Review process maps and plant layouts,
and ask for descriptions of how a process
works. Understand inputs and outputs to
a process being reviewed. Stream or record
short videos in high-risk select instances.
+ Missed visual cues. Turn on the video during
a virtual meeting, for instance, and ask the
auditee to do the same when asking specific
or pointed questions. This is not as import-
ant if someone is just providing a general
description of how a process works.
+ Poor time management. Read two to three
times as many documents in advance as you
typically would for an on-site audit so you can
be as efficient as possible in your questioning.
Begin the records review before the audit if the
auditee will send them. When possible, complete
the review of documents and records pertaining
to certain low-risk aspects of the QMS before
the audit so minimal interview time is taken up
during the audit execution around those topics.
+ Reluctance to email documents and records.
If auditees resist, suggest screen sharing to allow
the review of documents and records during the
audit. Request remote guest access to review
Process outputs
+ Audit report
+ Audit records
+ Risks
iStock.com/Ani_Ka
Yuichiro Chino via Getty Images
Conducting a robust remote audit can be time
consuming and difficult. If you don’t find it that way,
you’re likely not doing it right.
files in advance without having to down-
load them.
+ Uncovering more system issues than perfor-
mance issues. Ensure that a broad range of
records is reviewed, including trend data.
+ Greater chance for distractions. Avoid
extended periods of time in which the audi-
tee is just sitting and waiting while the auditor
reviews documents or records. Leave the vir-
tual meeting space when that must be done
and reconnect when finished. Avoid having
multiple people waiting while one auditee
must provide a lengthy question response.
+ Discomfort with a virtual environment (either
auditee or auditor). Do a practice run before the
first meeting. Know simple troubleshooting tips
(for instance, audio troubles including squeals
and feedback). Have IT on standby to assist.
+ Differing time zones. Be mindful when sched-
uling meetings. Know what time it is in the
auditee’s location. The auditor is the one who
should be accommodating when early morning
or late-night hours are necessary.
Auditing best practice
A remote audit is just that: an audit. General best
auditing practices should apply. Don’t fall into
the trap of not using best practices during your
audit because it is “just” a desk (remote, virtual
or e-​audit—choose your word here) audit.
Then, of course, there are best practices more
germane to the virtual world. A map of the virtual
audit process is shown in Figure 1. Beware of the
risks of conducting a poor remote audit that can
lead to the risks of poor supplier oversight, as well
as risks of management making a poor decision
based on faulty audit data.
In general, here are some auditing best prac-
tices for you to incorporate into your remote
audit activities:
General planning. Review the last audit report
in addition to performing a 12-month review of
nonconforming material reports, corrective and
preventive actions, corrective action requests,
complaints and other data to help determine
audit strategy, focus and development of a check-
list. Request a document matrix to help select the
best sample of documented information to review.
Remote planning. Allow gaps in the schedule
to break and review documents and records.
Be sure all audit team members are comfortable
and technologically compatible with the platform
being used. Determine which objective evidence
qualityprogress.com ❘ September 2020 QP 21
 F E AT U R E
AUDITING
TA B L E 1
Preparing for a remote audit
Remote vs. on-site preparation
Audit process aspect comparison
Planning Additional considerations for remote
Meetings Additional considerations for remote
Data integrity review Fairly equivalent
Interviews Fairly equivalent
Observations Additional considerations for remote
Technology Multiple unique aspects for remote
External standards Fairly equivalent
Historical record review Fairly equivalent
Reporting Fairly equivalent
Managing audit risks Additional considerations for remote
would be OK to review asynchronously, and which
evidence would be best to review with the auditee.
Remote audits provide an opportunity to send
certain questions in advance with a request for
objective evidence so the auditee can be ready
to review when the auditor engages them.
General execution. Conduct opening, closing
and end-of-day meetings. Include time in the
schedule for consolidation or discussion (if more
than one auditor) of the day’s findings prior to
presentation. Be considerate of the auditee’s time.
Conduct interviews with multiple people and not
just the management representative. Maintain
a conversational and convivial style throughout
the proceedings.
Remote execution. Be sure to allow 30 minutes
prior to the scheduled start time to troubleshoot
any unexpected issues. Sometimes, the results of
22 QP September 2020 ❘ qualityprogress.com
a remote audit are that a follow-up on-site audit
must be conducted. That should be made clear
during the opening meeting if that’s the case.
Be efficient. Have a list of documents and
records to be pulled when you break to review
information. Also, when there are two auditors,
have one offline preparing while the second
engages with the auditee. Then, the second auditor
can log into the meeting to ask his or her questions
while the first auditor logs off to review other docu-
mented information.
Don’t be afraid to request photos or short videos
of complex or high-risk areas. The auditee may
decline, and you don’t want to make this request
lightly, but it doesn’t hurt to ask when reviewing
additional visual information is warranted. This
request might lead to additional dialogue around
other possible options for getting this information
(for instance, determining timing, signing a nondis-
closure agreement and scheduling an on-site visit).
General reporting. The audit report should
include a definition of finding classifications and
expected response timelines, as well as detail
and summary information relating to the audit pur-
pose, scope, team and results. When documenting
a finding, the statement should include what the
requirement is, what was observed, a conclusion
and justification (one to two sentences) for that
conclusion. Make sure the audit report form has
checkboxes to indicate whether the audit con-
ducted was on site or remote.
Remote reporting. Screen share so the auditee
can see the findings as you review them. Excerpt
just the audit conclusion and findings from the
report to screen share so you don’t need to scroll
through pages of information to get to what the
auditee most cares about: audit results.
General closure. Close as appropriate and within
the expected timelines per your existing proce-
dures. Though photos, if sent, may be included in
the audit report, be sure to delete any files sent to
you as objective evidence because this is company
confidential information belonging to the supplier.
Etiquette. Put special emphasis on assurances
that information shared will be kept confidential.
Be sure to ask permission before screen capturing
any information presented. Work from a location not
prone to background noise or poor lighting. Remain
attentive and focused when someone is speaking or
Updated Quality
Auditor Handbook
Lance B. Coleman Sr.’s latest book, the fifth edition of The ASQ
Certified Quality Auditor Handbook, was published late last
month by Quality Press. The handbook is an in-depth overview
of the principles, implementation and uses of quality auditing
and aligns with the most recent certified quality auditor body
of knowledge. For more details, visit asq.org/quality-press.

presenting. Do everything you can to ensure there
are no delays or issues caused by your lack of under-
standing of how the auditing platform works. Lastly,
“please” and “thank you” always work.
Time and preparation required
The on-site and remote comparison matrix (Table
1) shows for various aspects of the audit process,
remote audits are comparable to on-site or more
complex ones. How can you afford not to put as
much time into preparing? Use the matrix as a
guide to determine where to focus your efforts
in preparing for a remote audit.
Conducting a robust remote audit can be time
consuming and difficult. If you don’t find it that way,
you’re likely not doing it right. Being comfortable
with the electronic platform used to conduct the
audit and having knowledge of basic troubleshoot-
ing tips also is important. By adhering to auditing
best practices while identifying and mitigating
the unique risks found in remote auditing, robust
remote audit results can be achieved.
What should you do when risk assessment
dictates that an on-site audit should be done,
but business realities state it can’t happen and
there’s no way to delay the audit? In such cases,
you would do the most robust remote audit
possible and couple the audit with other controls.
Two examples of such a scenario would be condi-
tional acceptance for new suppliers or increased
acceptable quality limits for new or existing suppli-
ers until an on-site audit is possible to supplement
the remote assessment.
Although the focus of this article is conducting
successful remote supplier audits, many of the
principles discussed also would apply to conducting
internal audits between sites.
REFERENCES
1. International Organization for Standardization,
ISO 19011:2018—Guidelines for auditing management
systems, 2018.
2. Lance B. Coleman Sr., Managing Organizational Risk
Using the Supplier Audit Program, Quality Press, 2018.
Lance B. Coleman Sr. is director of
quality for IDEX Health and Science
LLC in Oak Harbor, WA. He earned
an associate degree in electrical
engineering technology from Southern
Polytechnical University in Marietta,
GA. A senior member of ASQ, Coleman
holds the following ASQ certifications:
quality auditor, biomedical auditor, quality engineer and Six
Sigma Green Belt, along with the Exemplar Global quality
management systems principle auditor certification. He is the
author of Advanced Quality Auditing: An Auditor’s Review of
Risk Management, Lean Improvement and Data Analysis (Quality
Press, 2015), Managing Organizational Risk Using the Supplier
Audit Program (Quality Press, 2018), and The Customer-Driven
Organization: Employing the Kano Model (Productivity Press,
2014). He also is editor of the Quality Auditing Handbook,
fifth edition (Quality Press, 2020).

qualityprogress.com ❘ September 2020 QP 23