Public health measures taken to mitigate the spread of the coronavirus (COVID-19) pandemic have upended business operations and processes. Auditing is no exception; traditional methods of collecting audit evidence rely upon in-person procedures that are impossible or impractical now and for the near future. Technology provides a number of possibilities for remote virtual auditing; the authors describe several options, including remote inventory observation, document collection, and risk assessment.
***
The onset of the coronavirus (COVID-19) global pandemic has resulted in enormous pressure on auditors and accountants to find alternative ways to collect audit evidence and complete the engagement. Depending upon the assessed risk of material misstatement (RMM) and the materiality of a given account balance, auditors rely upon physical in-person evidence collection procedures, such as inventory observations, inventory verification, document collection, property, plant, and equipment (PPE) assessment, interviews, discussions, and observations. With the confinement brought on by COVID-19, is it possible to be an effective and efficient auditor?
This article will discuss remote virtual auditing—first-person view (FPV) cameras and drones, video feeds, artificial intelligence (AI) video assessment tools, and other technologies that can assist in conducting a remote audit examination. These methods offer several benefits, but they also present issues that must be addressed. In addition, audit risk assessment evaluations should be revisited in the current environment, where businesses and commerce in many industries have come to a halt and the unemployment rate rivals that of the Great Depression.
Audit Evidence Collection Procedures
Audit evidence is defined by U.S. GAAS as: “all of the information used by the auditor in arriving at the conclusions on which the audit opinion is based” (SAS 106; AS 15). This information consists of the accounting records themselves and all other information obtained during audit procedures performed during the engagement, in addition to records from previous audits and the firm’s own quality control procedures (AU-00326.02).
Generally, audit evidence is more reliable if it is obtained from sources external to the entity, if it is in documentary form, or if it is obtained directly from the auditor. The reliability and quality (appropriateness) of this evidence forms the basis for determining the sufficiency or quantity of evidence that must be collected. The reliability and sufficiency of audit evidence needs to be considered when assessing risks and designing audit procedures (AU-00326.06). SAS 106.20–.42 describes the types of procedures that an auditor may undergo to obtain audit evidence; these are illustrated in Exhibit 1.
Exhibit 1
Audit Evidence Collection Procedures
Although many continuous evidence collection processes are now feasible due to widespread adoption of enabling technologies, the tasks of observation, PPE assessment, interviews, document collection, and inquiry may still be conducted physically. These audit evidence collection processes, even if enhanced by technologies such as radio frequency identification (RFID) tags and process flows, often require a physical presence to verify the relevant assertions of existence, occurrence, and valuation (SAS 106.08). These are the areas of evidence collection that are particularly challenging in today’s environment of social distancing and quarantines. What follows is a review of evidence collection procedures that are more physical in nature and how audit staff can comply with AICPA and PCAOB requirements while working remotely.
Inventories during COVID-19
AU section 331 (AICPA, 1972) provides guidelines regarding inventory procedures, whether sample inventory count observations or a complete count. When inventories are conducted manually by the client, the auditor should be physically present to observe, test, and inquire. If the entity has kept frequent perpetual inventory checks, the auditor’s observations may occur either during or after the audit. Verification of automated inventory systems with RFID tracking follows this guidance. For automated inventory systems, often the auditor may observe a sample of the inventory count (D. Appelbaum and R.A. Nehmer, “Using drones in internal and external audits: An exploratory framework,” Journal of Emerging Technologies in Accounting, vol. 14, no. 1, pp. 99–113, 2017).
Presenting videos as audit evidence may be a novel, and possibly controversial, approach. These are extraordinary times, however, and perhaps some flexibility and ingenuity are desirable.
AU-C section 501, “Audit Evidence—Specific Considerations for Selected Items,” expands on the process of inventory observation that was summarized in AU-C section 331. The auditor should evaluate the inventory procedures, observe and inspect the inventory, and perform test counts. If the physical inventory is conducted at a date other than that of the financial statements, the auditor should perform the observation on another date and then perform backtracking or forwarding audit procedures to calculate the inventory count. A similar process should occur if the count occurs at a time that the auditor cannot be physically present. If the inventory is held by a third party, the auditor should seek confirmations if a physical inspection is not possible.
How can an auditor satisfy the physical requirements of inventory observation and validation at this time when authorities have discouraged or even forbidden large gatherings and unnecessary travel? With some creativity, this situation is not impossible to resolve, and we provide ideas that may satisfy AICPA and PCAOB requirements. As suggested by AICPA Chief Auditor Bob Dohrer, roll forward and roll back procedures may be possible if earlier observations were made and there is reasonable certainty that restrictions might lift in the near future (https://bit.ly/3gNhPPE). Furthermore, the PCAOB (AS2510.10) states that if the client has demonstrated and verified reliable and complete perpetual inventory records in the past, the auditor’s observation could occur at some time other than period or year end. For these audit clients, this may be the most viable immediate solution. For engagements where inventory is material to the financial statements and where the auditor is compelled to rely on physical observations and inspections, and the audit client is a nonpublic company, AU-C sections 501.11 and .14 apply, wherein an auditor might not need to attend inventory counting if it is “impracticable.” Roll forward and roll back would still apply, but due to the risk of auditor safety, the auditor could claim that physical presence is impracticable.
With devices that can provide live video streams or video recordings, auditors may still be able to conduct a “first person view” (FPV) or “auditor first view” (AFV) inventory observation. The assumption is that the audit client would have at least one employee or more conducting an inventory count. This employee could strap on a GoPro camera, or wear a Google Glass headset, which could be in constant communication with the audit team via smartphone, and honor their requests while providing live video streams of the inventory process. The audit team could simultaneously record these video feeds, thereby providing strong nontraditional audit evidence of an inventory verification.
Presenting videos as audit evidence may be a novel, and possibly controversial, approach. These are extraordinary times, however, and perhaps some flexibility and ingenuity are desirable. There is minimal guidance from the PCAOB and the AICPA regarding the reliability of videos as audit evidence specifically; one must infer from the current, general standards. Videos recorded by a third party or by the audit client provide a weak source of audit evidence, but this might be appropriate when the subject matter is not material.
Recordings of live video streams which were monitored and verified in real-time by the auditor are another matter altogether. There ostensibly would be little difference between this situation and an auditor being physically present at an inventory count. If the auditor is “present” and recording the video streams as they occur on her own secure computer, how is this not equivalent or better than being there physically? These video files could always be examined to establish their validity and provenance (T. Gloe, A. Fischer, and M. Kirchner, “Forensic Analysis of Video File Formats,” Digital Investigation, vol. 11, pp. S68–S76, 2014). In some cases this evidence might be much better than what is observable, as the auditor can review the videos and pictures at a magnified scale and as often as desired.
Ideally, employees and auditors should be technically savvy and able to quickly learn these technologies. There could be issues as to who exactly should be providing the AFV video stream—a member of the accounting firm who lives nearby? An internal auditor, accountant, or other client? An external third party? Remember that during this time, it is crucial to limit unnecessary travel and potential exposure to COVID-19; the video feed process might not be feasible if no one is there to manage the camera. Finally, it may be difficult to detect details in the video feeds, such as identifying damaged/dusty goods or items that do not smell right (foodstuffs, chemicals, other organic compounds), thus lessening the auditor’s comfort with using a video app. Some drones, however, may be fitted with an “electronic nose” or sensor which detects certain chemical compounds in odors that indicate decay.
During the process of inventory observation, an auditor might request that a picture be taken of certain inventory views. It is quite possible that these inventory items could be quickly counted in either a snapshot or video view using image recognition software such as CountThings (https://countthings.com/). With this software, items such as boxes, pills, lumber, trees, cars, semi-trailers, and raw diamonds that have been captured with either still pictures or videos may be easily counted using pre-learned templates specific to these items. The AI software can also “learn” new items to count. An auditor would still review the counts for accuracy, but the task of counting objects in a picture or video has been assisted by the initial application of an AI picture recognition software. Exhibit 1 shows a small sample of items available to count at CountThings.
One consideration for any auditor using a new technology is that it should be verified. The pre-programmed component of these tools should be evaluated. This typically requires the identification of relevant testing scenarios and inputs and then an evaluation of the tool’s output (through manual recalculation or comparison to another tested tool with comparable capabilities).
PPE Evaluation during COVID-19
For Inspection of Tangible Assets, SAS 106.29 states that this process consists of physical examination of physical assets to verify their existence and assist in the determination of valuation by providing information about the assets’ condition. This inspection, if involving actual inventory counts, requires observation or inquiry accompanying this activity. Auditors typically open boxes or conduct other measurements to verify the amount of goods or condition of assets. Other tasks might include verifying the general condition of a building, equipment, or land to corroborate its stated financial value.
During the COVID-19 crisis, some of these tasks that occur during inventories, such as verifying the contents of a box, may be conducted through an AFV audit process. The AFV process could also be undertaken for evaluating the physical condition of PPE in substantiation of claimed financial value. For example, an auditor could participate in the examination of a building roof as a real-time video-streamed participant. In fact, the audit team may want to continue this practice post-COVID-19, for examinations where outside experts are hired for an evaluation process. The recording of live video streams of the examination process provides invaluable evidence for the engagement. Additionally, using a drone for AFV observation can be quite feasible (Appelbaum and Nehmer, 2017), since many drones can be outfitted with a FPV camera that may be reconfigured to include the auditor in this first-person view.
Document Collection during COVID-19
Most of the documentation required by auditors should be electronically available. It is possible, for example, that receiving reports are signed and stored at the recipient’s warehouse dock, or that the confirmations provided by banks, vendors, customers, and attorneys are paper documents. To provide electronic versions of paper receiving documents, client staff could provide dated pictures of the requested signed reports; these pictures should be forensically examined to establish authenticity and provenance. Communications with banks, clients, vendors, and attorneys regarding confirmations could begin with a secure e-mail from the client directed to the auditor.
Observations during COVID-19
SAS 106.30, Observation, consists of looking at a process or procedure being performed by others; for example, watching the process of inventory counting or controls processing constitutes observation. The observation is only valid, however, for the point in time when it occurs and is constrained by the fact that being observed may affect how activities are performed. Many audit clients may have installed cameras throughout their facilities, providing further sources of observation. Live video streams or pictures that are verified by the auditor while being created are preferable to those recorded by another party. With the former, the audit team can claim beginning-to-end custody of the evidence.
The timing of the COVID-19 pandemic and the subsequent broad-scale shutdown of the economy will have a major impact on audit risk assessments.
Interviews during COVID-19
During this time of quarantine and self-isolation, the audit team may be required to conduct interviews and discussions with management. Whereas such interviews and discussions generally occur in person, such interactions will now likely to happen via video-confer-encing tool, such as Zoom, Skype, or GoToMeeting. Auditors should be aware of certain limitations to video conferencing:
- It might be difficult to pick up nonverbal clues and gain an intuitive understanding of the other individual with video conferencing, although reviewing video recordings later can mitigate this weakness or even improve upon the traditional process.
- Eye-to-eye contact occurs more easily in person and less often with video. Both parties should familiarize themselves with and follow best practices (e.g., looking directly in the camera).
- Auditors should be familiar with the tools to be used and should have a “waiting room” or passwords for meetings. Such controls are absolutely critical, given that some discussions could be sensitive in nature and video meetings have been hacked where such robust security and privacy controls were not in place.
Audit Brainstorming during COVID-19
Likewise, during a COVID-19 shutdown, audit brainstorming will need to occur via online meetings. Ideally, the app used will allow not only screen sharing but also keyboard and mouse sharing among audit team members. Because the audit team is not in daily in-person contact, daily online meetings may be used to maintain continuity regarding the engagement.
Audit Risk Assessments during COVID-19
The timing of the COVID-19 pandemic and the subsequent broad-scale shutdown of the economy will have a major impact on audit risk assessments. An auditor might already have a generic risk consideration for the possibility of a natural disaster or, even more remotely, a pandemic. But how does the COVID-19 pandemic specifically affect each client’s business plans, access to capital, liquidity, financial condition, and operations? Has COVID-19 impacted demand for a client’s products or services, directly or indirectly? Have a client’s processes been interrupted due to supply chain issues, difficulty establishing remote access with staff, or a reduction in the workforce (whether caused by illness, closures, or layoffs)? What other changes have affected a client’s business? The inherent general economic risk—such as the nature and likelihood of a recession—should also be re-examined in light of COVID-19. These are but a few considerations for risk assessments during COVID-19 and its aftermath.
Auditors should be aware of the ever-present issues of fair value, going concern, and subsequent events (https://bit.ly/2XSjMBn) and how these are being affected by the COVID-19 crisis.
- Fair value. The shutdown of the economy significantly impacted the securities markets and their pricing. Some securities may be less liquid, with less frequent observations and more frequent price fluctuations. Auditors should be cognizant of FASB guidance regarding inactive markets, disorderly transactions, and declining levels of valuation and their degree of impact on your client. Lastly, auditors should carefully review any disclosures regarding valuations and whether market volatility and lack of liquidity is accounted for.
- Going concern. With the broad shutdown of the economy, an auditor should pay additional attention to the going concern evaluation. An auditor should look at the client’s debt level, the viability of its source of alternative sources of revenue, the diversity of its strategic plans, and its cash flows prior to COVID-19. If the broad outlook for COVID-19 is not definitive during the audit examination period, the auditor should be cautious with her estimates.
- Subsequent events. According ASC Topic 855, there are two types of subsequent events—those that provide additional evidence about conditions that existed at the date of the balance sheet (type 1) or events that provide information about events that did not exist at the date of the balance sheet but arose after that date (type 2). The main issue for consideration is whether these type 2 events are material to the financial statements, and if so to what extent should these events be disclosed. Given that these disclosures could be speculative or judgmental in nature, auditors should act prudently.
The COVID-19 pandemic spread during the audit examination period for calendar-year public filers, with significant changes in business and the economy transpiring during the month subsequent. The SEC has extended by 45 days the due date for any filings from March 1 to July 1 (https://www.sec.gov/rules/exorders/2020/34-88465.pdf). To secure this extension, the following steps should be taken:
- Registrants should provide a Form 8-K explaining how COVID-19 is impacting the company and its ability to file, and when it anticipates that it should be able to file. The registrant should also list company-specific risk factors that have impacted its business and operations.
- If the delay results from an inability for a third party (such as an audit firm, outside experts, or law firm) to provide a report, opinion, or certification, the Form 8-K must also provide a signed statement from the third party explaining the nature of the delay.
- The registrant’s delayed report should be filed within 45 days of its original filing due date. The SEC also states that this exemption may be reconsidered in light of ongoing COVID-19 developments.
- Requirements for manual signatures are also being relaxed, due to the concerns caused by COVID-19 (https://www.sec.gov/corpfin/announcement/staff-statement-regarding-rule-302b-regulation-s-t-light-covid-19-concerns).
Exhibit 2
Sample of Templates Available at CountThings
What Next?
The global COVID-19 pandemic has resulted in enormous pressure on auditors to find alternative means of collecting audit evidence and completing engagements. Mandatory closures of many businesses have been extended beyond the grace period offered by the SEC. But somehow the audit staff must continue with its engagement tasks. With the confinement brought on by the pandemic, is it possible to continue to be an effective and efficient auditor?
The answer is: yes. The discussion above describes how to perform a remote virtual audit utilizing FPV cameras and drones, video feeds, AI video assessment tools, and other technologies. Given the nature of the current constraints, regulators should afford auditors greater leeway to deploy more innovative technologies for evidence collection. Now is the appropriate time to expand the current standards to include complimentary and supplementary technologies that, when needed, could suffice as direct physical evidence collection methods.
These are not normal times. Lenience by regulators, creativity by auditors, and flexibility by clients are necessary. Some of these steps described above, and some additional technological and analytical improvements, will arise due to need. These may substantially facilitate the ability of the audit profession and its regulators to adapt to emerging technologies. Or, these evolutionary measures may prove themselves to be superior to traditional audit evidence collection methods and be incorporated into audit practice going forward.
