I have been doing IT audits for a long time and I have always believed that being in the room matters. Not just for the formal interviews and the process walkthroughs, but for the informal conversations that happen in hallways, the observations you make by simply being present in an environment, and the relationship-building that makes subsequent audit cycles easier and more productive.
March 2020 removed that option for most of us and the question now is not whether remote auditing is going to be part of our practice but how we do it well.
What Makes Remote Auditing Hard?
The core challenge with remote auditing is not the technology. Most organizations have videoconferencing platforms, document sharing capabilities, and screen-sharing tools that can replicate most of what an in-person fieldwork visit accomplishes. The challenge is discipline and rigor. When you are sitting across from a process owner in a conference room, the structure of that interaction tends to keep things focused. Remote interviews require more deliberate preparation, more explicit agenda-setting, and more careful documentation of what was observed and how, because you will not be able to supplement your notes with the contextual observations you would have made in person.
How Do You Gather Audit Evidence Remotely?
Evidence gathering requires more structured coordination. In a traditional audit, handing someone a request list and sitting nearby to answer questions as they pull documentation creates a natural workflow. Remotely, you need to be more explicit about evidence format, submission mechanisms, and how you will verify that what you receive matches what you requested. Screen-sharing walkthroughs of system configurations and access controls, when documented properly with screenshots and timestamps, can be a reasonable substitute for observing a live demonstration in person.
Do Audit Programs Need to Change for Remote Work?
The internal control frameworks that guide IT audit practice have not fundamentally changed because of remote work, but the audit programs we use to test those controls need to be updated to reflect remote-appropriate procedures. ISACA has been developing guidance on this and their resources are worth reviewing as you update your audit programs. Their published standards and guidance, including the IT Audit Framework (ITAF), are available at ISACA’s IT audit resources.
CISA Boot Camp
Instructor-led, with the exam voucher included.
Does the CISA Cover Remote Auditing Skills?
From a certification and professional development standpoint, the skill set that remote auditing demands, structured communication, rigorous documentation, technology-mediated evidence gathering, is consistent with what CISA (Certified Information Systems Auditor) and related credentials have always tested. The fundamentals have not changed. The methods have adapted. Audit professionals who update their fieldwork practices accordingly will find that remote audit is a workable, if imperfect, substitute for the real thing. And given that some version of hybrid remote work is likely to persist beyond this crisis, getting good at remote audit methods now is genuinely worth the investment.
Frequently Asked Questions
Can you take the CISA exam remotely?
Yes. ISACA offers the CISA exam at PSI test centers or through online remote proctoring at home. Registration is continuous, so you can schedule throughout the year.
How long is the CISA exam and what score do you need?
The CISA exam has 150 questions and you get four hours to complete it. ISACA reports scores on a scale of 200 to 800, and you need 450 or higher to pass.
What experience do you need for CISA certification?
You need at least five years of information systems auditing, control or security work experience gained within the 10 years before you apply. You can sit the exam first and then have five years after passing to apply for certification. ExamNav offers a CISA boot camp.
Which CISA domains carry the most weight?
Information Systems Operations and Business Resilience and Protection of Information Assets each make up 26% of the exam. The Information System Auditing Process and Governance and Management of IT are 18% each, and Acquisition, Development and Implementation is 12%.
How do you maintain a CISA certification?
You must earn and report at least 120 CPE hours over each three-year period, with a minimum of 20 hours every year. CISA holders must also comply with ISACA’s Information Systems Auditing Standards.
What framework guides IT audit and assurance work?
ISACA’s IT Audit Framework (ITAF), now in its 5th edition, sets standards for the roles and responsibilities of IT audit and assurance practitioners. It also gives guidance on planning, performing and reporting audit engagements.
Related reading
- GDPR Just Went Live. Here's Why Your IT Audit Program Isn't Ready.
- What the CISA Exam Gets Right About Cloud Security in 2023
- CISA (Certified Information Systems Auditor) boot camp
Kim Walsh is a CISSP and seasoned cybersecurity practitioner with deep, hands-on experience in enterprise security architecture, risk management, and compliance. She is passionate about bringing the next generation into the IT and AI space, actively mentoring young people who are just finding their footing in the field. As the mother of five kids, she has both the patience and the battle-tested communication skills to explain just about anything to just about anyone.
