Given the limited resources available to execute audits and the time-frame allocated to undertake audit activity, it is largely impracticable to perform all planned activities and reviews that are scoped for an audit exercise. Essentially, the audit team are forced to limit its audit samples to enable it meet up with delivery deadlines even when the audit samples are grossly inadequate as such, making it difficult to do a good job and still meet up with deadlines.
To overcome this, the audit team must plan better by identifying activities that will be performed offsite (i.e. audit team’s location) and those that will be performed onsite (i.e. in the audit client’s location). This will help in optimizing cost, increase efficiency, reduce wastages and time required to perform an audit. Some of the activities that could be perform offsite are as follows.
- Review of documents such as manuals, policies, operating procedures, standards, regulations, minutes of meetings, etc.
- Logical access control review.
Other activities that cannot be performed offsite will then be performed onsite such as interviews, process or system observation, walk-throughs, evidence examination, etc.
- Other reviews requiring system access (i.e. online review).