Remote audit and work-from-home controls differ from on-site fieldwork in four specific ways that firms need to deliberately rebuild rather than assume will carry over: physical access to original documents and assets has to be replaced with a defined process for scans, photos, or live video verification; the informal supervision a senior gets by sitting near juniors disappears and needs an explicit substitute; home network security becomes part of the firm's data security posture whether the firm planned for that or not; and physical observation procedures like stock counts need an evidenced remote-equivalent or genuinely cannot be done remotely at all.
1. Physical document and asset access
On-site, a junior can walk to the file room and pull the original invoice. Remotely, every document request becomes a round trip through the client, which changes both the speed and the reliability of evidence gathering — a scanned document can be cropped, altered, or simply be of a different document than what's claimed, in ways that handling the original on-site would have made obvious immediately.
- Define upfront which documents require the original at some point in the engagement versus which a clear scan is genuinely sufficient for.
- For anything high-risk, consider a live video walk-through with the client turning pages or opening a physical file in real time, rather than relying on a static scan alone.
- Keep a record of exactly how each piece of remote evidence was obtained — this becomes relevant if its reliability is later questioned.
2. Informal supervision
A senior sitting near a team at a client site picks up a huge amount informally — overhearing a junior's confusion about a procedure, noticing someone stuck on the same schedule for three days, seeing body language when a client conversation goes badly. None of that transmits through a shared drive. Without a deliberate substitute, remote teams can go days without anyone noticing a junior is stuck or has misunderstood a procedure.
- Short, structured daily check-ins rather than relying on juniors to proactively flag problems.
- Reviewing working papers at intermediate stages, not only at the end, specifically to catch a misunderstood procedure before it propagates through the whole file.
3. Home network and device security
A home Wi-Fi network with a default router password, a personal laptop shared with family members, and a client portal left logged in on a shared device are all now part of the firm's effective security perimeter the moment fieldwork moves home — whether or not the firm's security policy was ever updated to account for it.
4. Procedures that genuinely require physical presence
A physical stock count, verification of a tangible fixed asset, or counting cash on hand cannot be fully replicated by video in every case — a camera shows what it's pointed at and nothing else, and a determined client can stage what's in frame. Some physical observation procedures genuinely require being there, and the honest answer for those is that remote isn't a full substitute, only a partial one with a documented limitation.
How we think about this
Lekhya's view is that remote fieldwork works well for anything evidence-based and document-driven, and should be treated with real caution for anything that depends on physical observation or informal supervision — the goal is matching the method to what's actually being verified, not defaulting to remote because it's convenient.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit workflow & automationStatutory audit planning checklistUnderstanding the entity, setting materiality, risk assessment at planning, and briefing the team against a realistic timeline — a rounded planning reference.
- Audit documentationReviewing and signing off audit working papersWhat a reviewer is responsible for, a defensible review order, writing points that get cleared properly, and why approval must lapse when the paper changes.
- Internal audit & IFCControl walkthrough documentation: what belongs in the fileWhat a control walkthrough has to establish beyond description, narrative versus flowchart formats, and the shortfalls that recur most often on file inspection.
- Audit data & extractsHandling client data securely during fieldworkPen-drive discipline, who can open the shared drive, and what happens to the client's data after sign-off: the practical hygiene that protects a firm handling someone else's accounting records.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.