The Impact of Teleworking on The Audit Mission

Nastase, Pavel; Ionescu, Corina Article The Impact of Teleworking on The Audit Mission Journal of Accounting and Management Information Systems (JAMIS) Provided in Cooperation with: The Bucharest University of Economic Studies Suggested Citation: Nastase, Pavel; Ionescu, Corina (2011) : The Impact of Teleworking on The Audit Mission, Journal of Accounting and Management Information Systems (JAMIS), ISSN 2559-6004, Bucharest University of Economic Studies, Bucharest, Vol. 10, Iss. 3, pp. 424-436 This Version is available at: https://hdl.handle.net/10419/310469 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. http://creativecommons.org/licenses/by/4.0/ Accounting and Management Information Systems Vol. 10, No. 3, pp. 424–436, 2011 THE IMPACT OF TELEWORKING ON THE AUDIT MISSION Pavel NĂSTASE 1 and Corina IONESCU The Bucharest Academy of Economic Studies, Romania ABSTRACT Because of the globalization trend and of the need to keep pace with changes in today’s changing environments, audit organizations are extending their teleworking facilities, given the multiple benefits both to auditors and to audit companies. The main purpose of this paper is to emphasize the features of the teleworking concept and to identify the key challenges auditors are facing when performing audit activities and audit missions from remote locations. Furthermore, this paper focuses also on the advantages brought by the on-line and continuous audit concept in order to successfully implement teleworking. The contribution of this research paper is represented by the results obtained within a survey conducted by the authors among various audit companies from Romania, with regards to the impact of the extensive use of teleworking in their organizations. The survey was designed to establish the reasons audit organizations are using teleworking audit teams and to identify the main differences between teleworking audit teams and traditional collocated teams. teleworking, audit mission, teleworking audit teams, collocated audit teams, on-line and continuous audit, IT security INTRODUCTION At the worldwide level, many companies are now extending the activities into their employees' homes, because the nature of these extended corporate networks is changing rapidly. In its earliest years, remote access was generally restricted to critical systems support staff for emergency support access. But the growing importance of information and information systems within the business environment has created a need for access to information in real time and at all times of the day or night. The 1 Correspondence address: Pavel Năstase, Faculty of Accounting and Management Information Systems, The Bucharest Academy of Economic Studies, Piaţa Romană nr. 6, Bucharest, Romania, Tel. +40 21.319.19.00, E-mail: pav[email protected]  The impact of teleworking on the audit mission Vol. 10, No. 3 425 adoption of the IT infrastructure to facilitate these new business needs has also opened the door to teleworking. The implementation of this new working process was relatively slow in the early years because of technical issues but today, products range from the simple telephone and fax machine to multimedia workstations, videoconferencing facilities, halo rooms and collaborative software. Now that the broadband and the IT infrastructures have reached the home environments, teleworking is extending very rapidly. Teleworking is becoming very popular among auditors, too, given the possible benefits to the employee such as: flexible working location, improved work/life balance, reductions in commuting times, and even the possibility of reducing citycenter congestion when you do have to go to the office. The audit company also wins because there can be expense savings on city-center office spaces, which can contribute to profit increase. There is evidence that teleworkers take less sick leave days as they continue to work from home, and even that teleworkers work more hours and more days in general, without being frustrated about the overtime. Increasing traffic congestion, air pollution, and parking problems, coupled with many auditors’ desires to work at home are emerging factors. In addition, many people have difficulty working outside of the home, for example, people who are handicapped or who have childcare / eldercare responsibilities. Audit organizations can reduce costs by letting people telework, while the demand for buildings and parking spaces can be reduced and therefore money can be re-invested in developing the audit organization’s activities. Auditors who live in different geographical areas who have no desire to relocate can also be recruited. Looking at the globalization trend, audit organizations need to implement teleworking in order to compete with their nearest national or international rivals. Teleworking has clearly arrived in today’s society and it looks set to be a permanent feature of the work environment of audit organizations. The main characteristics as well as the challenges generated by the implementation of teleworking in audit organizations will be emphasized in this article, followed by some concrete examples which represent the authors’ personal contribution. This research paper presents also the results of a survey performed by the authors by interrogating some representatives of audit organizations with regards to the impact of the extensive use of teleworking in their organizations. 1. ON-LINE AUDIT AND CONTINUOUS AUDIT Auditors are encouraged to use teleworking when performing audit missions, because of the broadening of the on-line audit concept. The main qualitative change of this type of audit in comparison with the traditional audit is represented by the possibility of accessing on-line, distance databases which means that a significant part of the Accounting and Management Information Systems Vol. 10, No. 3 426 audit can be performed without the physical presence of the auditors at the audited entity’s headquarters. The on-line audit is an advanced and extremely useful type of audit which can deliver results during the entire audit mission and having significant consequences in the decision making process. Its main advantage is the fast access to data and the promptitude in processing them. The utilization of IT tools is most adequate to financial audits, because the audited entities preserve their financial statements in electronic format. According to Popa and Ionescu (2005), the on-line audit involves gathering all the information related to the audited entity from public databases and analyzing the electronic documentation, statements and explanations. The main challenge of on-line audit is to create a framework of accessing the audited entity’s data under maximum protection conditions of the information security and integrity. Given the context of the extensive use of information systems in the worldwide economy, it will be necessary to create special infrastructure platforms which make the evolution to e-audit systems possible. The e-audit allows the globalization of information exchange, the increased utilization of IT applications, the standardization of audit procedures and the access to information respecting all security standards. This evolution of the audit mission makes it possible for audit organizations to encourage teleworking among their employees. The increased frequency of audits has led to a qualitative evolution of the on-line audit, to a more sophisticated form, represented by the continuous audit. This new type of audit involves the continuous interaction of the auditor with the system of the audited entity so that he or she can lively evaluate the processes and activities of the organization. The continuous audit concept has been developed because of the need of following up in real time all transactions that occur within an organization, in order to avoid financial disasters such as in the case of the companies Enron and WorldCom (Năstase et al., 2007). Even if it has many advantages in comparison to the traditional audit, the continuous audit of the financial information systems involves a broader evaluation analysis because the auditors do not offer only one report at the end of each quarter, but they need to provide more frequently audit reports. The utilization of on-line and continuous audit in teleworking environments is enabled also by the implementation of Business Intelligence applications both in audit organizations and in the various types of entities from all areas of activity, such as commerce, manufacturing, banking, retail etc. Using Business Intelligence, auditors can achieve information about a company’s customers, competitors and internal business processes and can analyze client and customer trends, evaluate the effectiveness of internal processes and study competitor patterns. Business Intelligence offers the auditors the expertise and the tools necessary for complying with new IT regulation and standards and helps them to perform faster and in realtime the process of gathering information and forming an understanding of the client’s business and environment. Because auditors obtain the necessary knowledge about the The impact of teleworking on the audit mission Vol. 10, No. 3 427 company’s activities and control system without spending so much time as in the case of traditional audits, the quality of the overall audit mission increases, while the risks are minimized (Năstase et al., 2009). This is the reason why Business Intelligence is a must in the case of teleworking auditors. 2. TELEWORKING AUDIT TEAMS Auditors working in teleworking teams have flexible features and are able to help audit organizations to increase efficiency of processes and leverage expertise in today’s information society. Furthermore, teleworking auditors can balance their working life by minimizing the travel time to meet with teams from the audited entity. Among the many advantages that teleworking creates, there is also the risk for the audit team not to achieve their objectives, due to the fact that some individuals might not be very well instructed on how to work together over distance, time zone and organizational boundaries. This paper tries to emphasize the challenges and the specific processes of managing teleworking audit teams and more precisely, the authors will elaborate a detailed overview of the communication, collaboration and IT security issues within virtual teams, both from the audit organization and from the audited entity. At the same time, we will focus, as well, on the information security methods which become a must in a teleworking environment. In order to establish a better understanding of the problem, this paper will evaluate teleworking audit teams and the way these are performing their activities against traditional audit teams to provide some expertise to the research. The teleworking trend in today’s society is very easy to understand, as the economy is moving faster and time is becoming insufficient for the multitude of activities that occur within every organization and therefore, also within the audit organizations. The evolution of information technology enables a variety of communication, collaboration and IT security tools that were previously unavailable or too expensive for most organizations to implement. This has led to the increased use of virtual teams and of teleworking employees by organizations for many reasons. Some reasons include the need to quickly address customer problems, develop products, deliver services and bring together a more diverse pool of employees across the organization. Teleworking auditors are now forced to use electronic collaboration technologies and other information techniques to cut costs related to travel purposes, reduce audit mission schedules and improve decision-making time and communication across organizations. In order to become successful in audit missions, on mid-term, organizations will need to find new ways of working across all types of boundaries through systems, processes, technology, and people (CPA Australia, 2009). Accounting and Management Information Systems Vol. 10, No. 3 428 3. COMPARISON OF TELEWORKING AUDIT TEAMS AND TRADITIONAL AUDIT TEAMS There are many common points between teleworking audit teams and traditional audit teams in terms of the overall structure, methodology and goal achievement. Irrespective of the audit team type, if both the teleworking and the traditional audit team have a similar objective, then they will follow the same methodology and perform the same activity life cycle in order to produce the desired results. According to the various researches done in this area, the fundamentals of the audit mission do not change if the audit team is collocated or dispersed. Audit managers of teleworking teams should prepare a set of procedures in order to meet the technical support needs of each team member. In case of network downtimes, incorrect software configuration or computer malfunctions, the traditional audit team can benefit from the support of the IT department right at the workplace, but the teleworking team member should be able to solve his/her issues on their own in order not to create losses to the business. If a teleworking auditor is unable to work because of technical issues, the audit mission could face delays and quality outcomes due to the dependencies of critical deliverables. The audit manager must assess the backup procedures in order to ensure that IT resources are made available to support teleworking auditors as soon as possible. If a technical issue is not fixed in a timely manner, the effects can be extremely damaging to the audit mission and the audit organization can even suffer important material losses. At the same time, this can lower the confidence of the audit team in the teleworking environment and that is why the audit manager should implement specific control objectives in order to ensure that information systems are working properly. The research methodology used for this paper consisted of a questionnaire containing five questions related to teleworking procedures. The target audience for this research was represented by Romanian audit managers and specialists with teleworking experience who received the questionnaire via e-mail, after a short call in which we explained them the purpose of this survey. Because of the short introduction about the aim of the survey, we managed to receive back six responses out of ten, from individuals in organizations that varied from relatively small firms to the Big 4 companies. The responses were grouped according to each question and analyzed qualitatively. The questionnaire was designed to understand both the advantages and disadvantages associated with teleworking audit teams and how audit organizations are managing the teleworking environment more effectively, while dealing with specific issues. The questions included in the questionnaire are listed below: 1. What are the main reasons your audit organization uses teleworking audit teams? 2. Does your audit organization have different techniques for managing teleworking audit teams compared with traditional audit teams? If yes, what are the main differences? The impact of teleworking on the audit mission Vol. 10, No. 3 429 3. Please list in order of usefulness up to 3 tools (technology, software) that auditors find useful when performing audit missions in teleworking environments. 4. What impact do teleworking audit teams have on the teleworking team members' morale? 5. What are the 3 most common control issues you have encountered with teleworking audit teams? Question 1: What are the main reasons your audit organization uses teleworking audit teams? The main reason behind most respondent’s organizations decision to use teleworking audit teams was definitely cost reduction and resource allocation constraints. Because of the increasing number of organizations acting in various regions of the country or even at worldwide level, it has become a reality that audit teams are made up of members from different locations who can work both from the organization’s headquarters and from their home offices. Almost all respondents stated that it is very expensive to often bring teleworking audit teams and teams from the audited entity together for face-to-face communication, because this includes travel, accommodation and other expenses (such as per diem, medical insurance etc.) for each teleworking team member. By using on-line or continuous audit, teleworking can produce travel cost reductions of up to 50% with huge gains in team productivity and morale. At the same time, a few respondents recognized that there are more and more employees who look to find audit organizations that do not require travelling, therefore, not being able to support a teleworking environment can result in dissatisfaction among employees and maybe even high turnover rates. One of responses to the survey emphasized a very critical issue which audit organizations need to take into account when dealing with an audit mission in the conceptualization phase or when the audit team is in the forming phase. In these particular cases, the audit manager should decide to bring the audit team together and not to allow teleworking because the face-to-face communication and collaboration are undoubtedly required in order to successfully accomplish the audit mission’s objectives. Furthermore, some audit organizations admitted that providing equipment for home offices or telework centers in outlying areas might be less costly than expanding or moving offices as the workforce expands. The respondents also stated that the demand for buildings and parking spaces can be reduced by implementing teleworking offices and therefore costs are being cut. Auditors who live in different geographical areas who have no desire to relocate can also be recruited. Because auditors work most of their time from their home offices, the number of seats assigned to each employee is Accounting and Management Information Systems Vol. 10, No. 3 430 reduced and therefore, the maintenance costs of a business location are being cut down. From the answers of two persons, we could understand that some organizations are using teleworking audit teams as a strategy for building a culture and a trend within the audit organization. Question 2: Does your audit organization have different techniques for managing teleworking audit teams compared with traditional audit teams? If yes, what are the main differences? Many respondents stated that they don’t use significantly different techniques for managing teleworking audit teams compared to more traditional audit teams, but they admitted that in the case of teleworking auditors some extra security measures must be taken. This answer was not surprising and could have been easily anticipated, because the added complexity of the teleworking audit team requires a different management and IT security approach than a more traditional collocated audit mission. All responses stated the fact that a teleworking environment causes changes in communication habits because the auditor does not evaluate the client directly at its headquarters and does not work face to face with the other audit team colleagues involved in the same audit mission. In some cases, teleworking may cause communication issues and people involved in the audit mission need to spend additional time to explain and communicate effectively with the teleworking colleagues. One respondent stated that in the case of an audit mission, because of a misunderstanding in the communication between a teleworking auditor and the rest of the team, a wrong action could had been taken that could had led to a misevaluation of a process, if the team wouldn’t have double checked that issue. Another interesting remark was the fact that the employees working too much from home sometimes lack an energy that collocated audit teams have, which may result in failure to successfully achieve the deadlines and objectives of the audit mission. Another difference between teleworking audit teams and traditional audit teams, identified by most of the respondents is the increased need of ensuring information security in order to protect three unique attributes of the information: confidentiality, integrity and availability. Proper planning and design of the overall security architecture is required to assure that these attributes are maintained, because it goes without saying that when working from home, the information security risks can be higher if additional security measures are not taken. Some respondents recognized that a comprehensive security process encapsulates and consolidates the three main processes of prevention, detection and recovery. Because information is an asset that requires protection, security measures must be taken to protect information from unauthorized modification, destruction or disclosure, whether accidental or intentional. These techniques should be adapted to The impact of teleworking on the audit mission Vol. 10, No. 3 431 the teleworking environment of the auditor (remote access methods, telework devices etc.). An answer to the questionnaire stated that, in order to enable a smoothly security recovery process for teleworking audit teams, a computer security incident response team (CSIRT) should be established with specific roles and identified responsibilities. AlAboodi (2006) suggests that a CSIRT should be formed to act upon security events in a timely manner. The goal of the recovery process is to restore the system to its original working conditions. The recovery plan should be clearly written and approved by the appropriate levels of management. All respondents admitted that, the increased flexibility granted by the teleworking environment to their audit teams, causes in most of the cases increased information risk, as well. The risk may be considered in two layers: the risk at the remote computer and the risk at the corporate network. Most of the respondents expressed their concern regarding the fact that, the audit company cannot protect the teleworker's PC at all times. If connected to the office network, the company can monitor the activity undertaken on the teleworker’s PC, but when not connected to the office network, there are various risks which can affect the performance of the teleworker's PC, such as: re-configuration of the existing software, installing unauthorized programs, downloading e-mail attachments and different Internet files from unsecured sources. In these cases, the information system does not respect compliance rules, by this breaking the corporate information standards and causing virus infections attacks which can negatively impact the audit organization’s performance in terms of information security software. All interviewed persons stated the fact that besides the risks due to insufficient network security procedures, there is also the risk of physical access to the company’s confidential information stored on the remote computer. If employees are working in the office, their computer is usually protected by various means of physical security and access controls, which include also, in case of large companies, a 24 hour on-site security personnel and surveillance equipment. In a teleworking environment there are usually no physical access controls which may increase the risk of the computer being stolen and/or the confidential data being misused by unauthorized persons. This may create severe financial losses for the audit company, leading even to compromising the business. Even if there are certain risks generated by the teleworking environment, if the audit organization performs a detailed evaluation of them and implements measures of control, the overall activity will not be affected. There are various strategies and procedures that can be considered by the audit organization in ordure to avoid exposure of confidential data to unauthorized users: strong and multiple authentication and authorization when logging to the corporate network and to the different applications and the use of the encryption software technology. An example of an