In-Person Versus Remote Work Environments and Risk: A Complete CIA Part 2 Engagement Planning Guide
Introduction
In CIA Part 2 (Practice of Internal Auditing), the Engagement Planning domain expects internal auditors to understand how the environment in which work is performed affects both the risks of the area under review and the way the engagement itself is planned and carried out. Since the widespread adoption of remote and hybrid work, The IIA has placed increasing emphasis on how in-person versus remote work environments change the risk landscape. This guide explains what the topic covers, why it matters, how it works in practice, and how to approach exam questions on it.
Why This Topic Is Important
1. Changed risk profiles: Remote work shifts where data lives, how employees access systems, and how supervision occurs. Risks that were contained within a physical office, such as access control, document security and direct oversight, now extend to home networks, personal devices and cloud platforms.
2. Impact on internal controls: Many traditional controls depended on physical presence, such as wet signatures, physical segregation of duties, locked filing cabinets and face-to-face approvals. When work moves offsite, these controls may weaken, disappear or be replaced by digital alternatives that must be evaluated.
3. Impact on the audit itself: Internal auditors may perform engagements remotely. This affects evidence gathering, the ability to observe processes, communication with clients, and the reliability of the information obtained.
4. Standards requirements: The IIA's Global Internal Audit Standards (Domain V, Performing Internal Audit Services) require auditors to consider the risks relevant to the engagement, to plan adequately, and to obtain sufficient, reliable, relevant and useful evidence. The work environment directly influences all of these.
5. Fraud risk: Reduced oversight and isolation can increase opportunity, one leg of the fraud triangle, and may also increase pressure through financial stress or job insecurity.
What It Is
This concept covers two related dimensions:
A. The auditee's work environment (risk to the organization)
This means assessing how in-person, remote or hybrid arrangements affect the risks and controls of the activity under review. Key considerations include:
- Information security and cybersecurity: home Wi-Fi, VPN use, phishing exposure, unsecured endpoints, bring-your-own-device (BYOD) policies.
- Data privacy and confidentiality: printing at home, family members overhearing calls, screen visibility, disposal of sensitive documents.
- Segregation of duties: smaller or dispersed teams may lead to one person performing incompatible duties.
- Supervision and monitoring: managers have less direct visibility, which increases reliance on system logs, key performance indicators and automated monitoring.
- Authorization and approval controls: a shift to electronic approvals and e-signatures, with a risk of approval bypass or credential sharing.
- Physical asset safeguarding: laptops, inventory or cash handled outside controlled premises.
- Culture, ethics and communication: weaker tone at the top, reduced informal communication, and lower employee engagement.
- Business continuity and operational resilience: dependence on cloud services, collaboration tools and third-party providers.
- Legal and regulatory compliance: employment law, tax nexus for employees working in other jurisdictions, health and safety in home offices.
B. The internal audit team's work environment (risk to the engagement)
This means assessing how conducting the engagement remotely or in person affects engagement risk and quality:
- Evidence reliability: scanned documents and screenshots may be altered. Originals or system-generated reports pulled directly by the auditor are more reliable.
- Observation limitations: it is difficult to observe physical processes, inventory counts or walkthroughs remotely. Live video walkthroughs or drones may partially substitute.
- Communication and relationships: reduced rapport, misinterpretation, and delays in responses.
- Data security of audit files: secure transfer and storage of auditee data.
- Supervision of audit staff: the chief audit executive (CAE) and engagement supervisors must adapt their review and coaching methods.
- Use of technology: greater reliance on data analytics, continuous auditing, and secure portals.
How It Works in Engagement Planning
Step 1: Understand the context. During preliminary survey, determine the work model of the area: fully in-person, fully remote or hybrid. Identify which processes, people and systems are affected.
Step 2: Identify risks. Use risk assessment tools such as risk and control matrices, interviews and questionnaires to identify risks unique to the work model. For example, in a remote accounts payable function, consider the risk of fraudulent vendor bank-detail changes through email compromise.
Step 3: Evaluate controls design. Determine whether controls have been redesigned for the environment. A control requiring a manager to physically sign checks is ineffective if staff work remotely and approvals are now made by email without verification.
Step 4: Set engagement objectives and scope. Include work-environment risks where significant, for example remote access controls, endpoint security or the effectiveness of virtual supervision.
Step 5: Determine the engagement approach. Decide whether fieldwork will be on-site, remote or hybrid. Weigh cost, travel, timing, the need for physical observation, evidence quality, and auditee availability. High-risk areas that require physical verification, such as inventory, cash or fixed assets, often warrant on-site work.
Step 6: Plan resources and tools. Ensure auditors have secure technology, analytics capability and the skills needed for virtual interviews. Consider time-zone differences and scheduling.
Step 7: Plan evidence procedures. Prefer direct system access with read-only rights, system-generated reports and independent confirmations. Use screen-sharing walkthroughs in which the auditor directs the process. Document limitations and compensating procedures.
Step 8: Communicate. Agree on protocols with the auditee, including file-sharing methods, meeting cadence, response times and confidentiality expectations.
Comparison at a Glance
In-person advantages: direct observation, stronger rapport, easier confirmation of physical assets, nonverbal cues during interviews, and immediate clarification.
In-person disadvantages: travel cost and time, disruption to the auditee, and limited geographic reach.
Remote advantages: cost savings, flexibility, broader coverage, greater use of analytics, and access to global teams.
Remote disadvantages: evidence authenticity concerns, limited observation, cybersecurity exposure, weaker relationship building, and difficulty detecting fraud indicators and culture issues.
Practical Examples
- Example 1: A payroll department moved to remote work. The auditor identifies an increased risk that one employee can both add employees and approve payroll, because staff reductions occurred. The planned procedure is to review system access rights and change logs.
- Example 2: An auditor plans a remote audit of a warehouse. Because inventory existence is a key assertion, the auditor concludes that on-site observation, or at minimum a live, auditor-directed video count, is necessary.
- Example 3: Employees email sensitive customer data to personal accounts so they can print at home. The auditor flags data privacy and data loss prevention risks for inclusion in scope.
Exam Tips: Answering Questions on In-Person Versus Remote Work Environments and Risk
1. Identify which environment the question is about. Is the question asking about risks to the organization's operations (auditee) or risks to the audit engagement (auditor)? Read the stem carefully, because the correct answer differs.
2. Think evidence reliability. When a question involves remote auditing, the IIA-preferred answer usually favors evidence obtained directly by the auditor, such as read-only system access or an auditor-controlled screen share, over documents supplied by the auditee. Remember the hierarchy: external and auditor-generated evidence is more reliable than internal, client-provided evidence.
3. Physical assets mean physical presence. If the key risk involves existence or condition of tangible assets, the best answer typically involves on-site observation or a robust, real-time alternative.
4. Look for control redesign. Questions often describe a control built for an office setting. The correct answer usually recognizes that the control may no longer operate as designed and that compensating or digital controls must be assessed.
5. Cybersecurity is the dominant remote risk. When asked for the greatest risk of remote work, answers involving unauthorized access, data breaches, phishing or unsecured networks are often correct, unless the stem points elsewhere, for example to segregation of duties.
6. Apply the fraud triangle. Reduced supervision increases opportunity. If a question asks why fraud risk rises in remote settings, choose the answer about decreased oversight or monitoring.
7. Risk-based planning. The best answer usually ties the choice of in-person or remote fieldwork to the risk assessment, not to convenience or cost alone. Be wary of answers that choose remote work purely to save money when significant risks require on-site work.
8. Watch for absolute words. Options stating that remote audits are always less effective, or that controls are never affected, are usually wrong. The IIA perspective is balanced and judgment-based.
9. Remember communication and planning. For questions about the first or best step in planning a remote engagement, look for answers involving understanding the auditee's environment, establishing communication protocols, and securing data-sharing methods.
10. Documentation of limitations. If remote work limits procedures, the auditor should document the limitation, perform alternative procedures, and, if the limitation is significant, communicate it to management or the board. It may also affect the engagement opinion.
11. Use elimination. Remove options unrelated to risk or to the work environment, then choose the one that best addresses the most significant risk with the most reliable approach.
Sample Question Walkthrough
Question: An internal auditor is conducting a remote engagement of the procurement function. Which approach provides the most reliable evidence that purchase orders were properly approved?
A. Requesting scanned copies of approved purchase orders from the procurement manager
B. Interviewing the procurement staff via video call
C. Obtaining read-only access to the ERP system and extracting the approval workflow logs directly
D. Reviewing the procurement policy document
Answer: C. Evidence obtained directly by the auditor from the system is more reliable than client-provided scans (A), testimonial evidence (B), or policy documentation (D), which shows design but not operation.
Key Takeaways
- Work environments change both organizational risk and engagement risk.
- Remote work heightens cybersecurity, privacy, segregation of duties, supervision and fraud risks.
- Controls designed for physical settings must be re-evaluated.
- Choose engagement methods, whether in-person, remote or hybrid, based on risk, required evidence and reliability, not cost alone.
- On the exam, favor auditor-obtained, system-generated evidence and risk-based reasoning, and avoid absolute statements.
