Remote and Hybrid Audits: Making ICT-Assisted Auditing Reliable
How to plan and conduct remote and hybrid audits that are as reliable as on-site audits
Key takeaways
- Remote audits use information and communication technology (ICT) to collect evidence when the auditor is not physically present.
- IAF MD 4 sets the expectations for using ICT in accredited certification audits; ISO 19011 gives general guidance for all audits.
- A feasibility check comes first: reliable connection, secure document sharing, ability to show the site, and confidentiality.
- Some activities, such as observing hygiene practices or physical conditions, are difficult to audit remotely; hybrid audits combine remote document review with on-site verification.
- Record which parts of the audit were done remotely and how, so the evidence can be judged.
1. When remote audits make sense
| Suitable | Less suitable |
|---|---|
| Document and record review | Observation of hygiene, handling and production practices |
| Interviews with management and support functions | Physical condition of buildings, equipment and storage |
| Follow-up of corrective actions with documentary evidence | Sites with poor connectivity or restrictions on video |
| Multi-site organisations with centralised processes | First certification audits of high-risk food sites, unless scheme rules allow |
| Internal audits across distant sites | Activities where confidentiality prevents sharing images |
Certification schemes set their own rules on what can be audited remotely. Some food safety schemes allow a blended approach with a remote document review followed by an on-site audit of operations.
2. Feasibility and risk assessment
Before confirming a remote audit, check:
- Technology: stable internet at all locations, cameras that can move around the site, screen-sharing and secure file transfer.
- People: auditees familiar with the tools; a guide on site to carry the camera.
- Information security: agreement on what may be recorded, shared and stored.
- Scope: which processes and requirements can be covered reliably.
- Contingency: what happens if the connection fails.
Document the result and the agreed approach in the audit plan.
3. Conducting the audit
- Test session: run a short technology check a few days before.
- Opening meeting: confirm the agenda, connection rules, breaks, and how documents will be shared.
- Live walk-through: ask the guide to show specific locations chosen by the auditor, not a prepared tour. Ask for close-ups of labels, records and equipment identifiers.
- Documents: request specific records live, rather than accepting folders prepared in advance.
- Interviews: speak to operators, not only managers, with cameras on.
- Time: allow extra time for sharing and technical delays.
4. Evidence quality
| Risk | Mitigation |
|---|---|
| Staged or pre-selected evidence | Auditor selects samples live from full lists |
| Limited view of the site | Ask for 360-degree views, specific corners, ceilings and floors |
| Altered documents | Ask to see records in the source system, with dates and audit trails |
| Misunderstanding due to audio quality | Confirm key points in writing in the chat or report |
| Confidentiality | Agree in advance on screenshots and recordings |
Record in the report which evidence was obtained remotely, by which method, and any limitations.
5. Hybrid audits
A hybrid approach often works best:
- Remote stage: document review, management interviews, KPIs, internal audit and management review records.
- On-site stage: operational processes, hygiene, physical conditions, interviews with operators, tracing samples.
This reduces travel and time on site while keeping direct observation where it matters most.
6. Common weaknesses
- No feasibility assessment, leading to poor connections and incomplete audits.
- Accepting only documents the auditee prepared.
- Not recording which parts were audited remotely.
- Covering operational controls remotely when the scheme requires on-site observation.
- Information security not considered.
Conclusion
Remote and hybrid audits are now a normal part of auditing. Done well, with a feasibility check, auditor-led sampling and clear reporting of methods and limitations, they can provide reliable evidence and save time. Done badly, they become guided tours. The difference lies in planning and auditor control.
Before your next remote audit, write down three things you will ask to see that the auditee cannot prepare in advance.