Auditors have to continue doing their job of auditing, but with the pandemic, audits now are rarely on-site. Many auditing firms are using remote technology to conduct audits, and companies are either forwarding files electronically, using cloud-based portals or meeting with their auditors over technology meeting platforms such as zoom and/or teams.

There are risks associated with moving audits from in-person reviews on-site in conference rooms to using remote meeting technology or cloud-based products. Those risks, to name a few, include the potential transmission of highly sensitive or personal information via insecure email, the ability to take screen shots or record technology sessions such as zoom and/or teams, and the capture of information electronically that was never captured before, and the storage and potential of access to highly sensitive information or personal information by cloud vendors.

In assessing these risks, companies may wish to consider redacting sensitive information before pdf’ing or emailing documents to auditing firms, sending all sensitive information using encryption software, no allowing any screen shots, photographs or recording to take place on zoom and/or teams calls if sensitive information is being shared, and performing due diligence on cloud-based software that auditing firms propose to use, including privacy and security measures taken by the cloud-based vendor and what access the vendor has to company data.

Finally, whether audits are completed in person or remotely, review and consideration of requiring contractual language to include data privacy and security, indemnification and responsibilities regarding data loss and/or unauthorized access is an important risk management tool in the event that a security incident occurs.