QA audits and remote quality audits: what they cover and how they work
Short answer
A QA audit is an independent check of how a team tests and releases software, measured against a standard or its own documented process. A remote audit does the same without visiting the site: the auditor reads records online, interviews people by video and follows the work through screen sharing.
The word audit covers three different jobs: checking a quality management system against a standard such as ISO 9001, checking how well a software team tests, and checking a product against a specification. Below is how each differs, how a remote audit is run, and where it falls short of being on site.
Three kinds of audit people mean by "QA audit"
| Type | What is checked | Measured against | Typical output |
|---|---|---|---|
| Quality management system audit | Whether the organisation follows its own documented processes | ISO 9001 or a sector standard such as ISO 13485 for medical devices | Findings, nonconformities and corrective actions |
| QA process audit | How a software team plans tests, reports bugs, automates and releases | A reference model (for example ISTQB practices) and what the team intends to do | A map of the current process, gaps and a prioritised plan |
| Product or compliance audit | Whether a product meets a specification, contract or regulation | The specification or the regulation | A conformance report |
An audit is different from testing. Testing looks for defects in the product. An audit looks at the evidence that the way of working produces reliable results. IEEE 1028 defines an audit as an independent examination of a work product or process against specifications, standards or agreements.
What a remote quality audit is
In a remote audit the auditor does not travel. Documents and records are shared through a secure workspace, interviews run over video, and live work is shown through screen sharing or a camera walkthrough. ISO 19011:2018, the guideline for auditing management systems, includes guidance on auditing virtual activities and locations, and the International Accreditation Forum publishes a mandatory document on using information and communication technology for audits (IAF MD 4).
Remote suits any audit where the evidence is documents, systems and people talking about their work. That covers most software QA audits, because a tracker, a pipeline and a test repository can all be shown on a screen.
| Remote audit | On-site audit | |
|---|---|---|
| Evidence | Records, system access, screen shares, interviews by video | Everything remote has, plus physical inspection |
| Best for | Software processes, document control, supplier checks, repeat audits | Production floors, labs, physical security, equipment |
| Scheduling | Sessions can be split across days and time zones | Needs everyone in one place at one time |
| Travel | None | Travel and lodging for the audit team |
| Main risk | Poor connections and evidence that is shown, not examined | Disruption to daily work |
How a remote QA audit runs, step by step
- Agree scope and criteria. Which teams, products and period, and what the audit is measured against. Without criteria there is no finding, only opinion.
- Sign confidentiality terms. NDA and, where personal data is involved, a data processing agreement, before any tracker, test or pipeline is opened.
- Request records in advance. Process documents, test plans, recent release records, a sample of bug tickets, pipeline configuration.
- Review documents. The auditor reads the records first and writes questions, so interview time goes on the unclear parts.
- Interview and observe. Short video sessions with the people who do the work, with a screen share to see a test run, a bug triaged or a release approved.
- Sample the evidence. Pick items yourself rather than accepting a curated set: a random set of closed bugs, the last five releases, a handful of test cases traced to requirements.
- Report. Written findings, each tied to the evidence and the criterion, and a plan in priority order.
- Follow up. Check later that the agreed fixes were made. An audit with no follow-up is a report on a shelf.
What a QA process audit looks at
- Requirements. Are acceptance criteria clear enough to test, and does anyone review them before the build starts?
- Test design and coverage. What is tested, what is not, and would anyone notice the difference?
- Regression and automation. Suite health, flaky tests, and whether the pipeline would stop a broken build.
- Bug handling. How bugs are written, triaged, prioritised and closed, and whether each failed test points to a ticket.
- Releases and environments. Test data, staging, release checks and what happens after release.
- Roles and decisions. Who decides a release is ready, and whether that person has the information to decide.
For a certification-style audit the list changes (document control, internal audit records, management review under ISO 9001 clause 9), but the method is the same: evidence against a criterion.
Where remote audits fall short
- Shown is not examined. A screen share can be rehearsed. Ask for direct, read-only access to the tracker or pipeline where you can, and sample it yourself.
- Physical controls. Access to a building, a lab, storage conditions or hardware cannot be judged by video.
- Culture is harder to read. Hallway behaviour and informal workarounds are easier to see in person. Interview more people, and ask each to show a recent real example.
- Connectivity and time zones. Plan shorter sessions and a written recap after each.
- Certification bodies set their own rules. For a certification audit, ask the body whether a remote audit is acceptable for your scope.
How we run QA audits
BetterQA is an independent QA company: we test and do not build, so an audit from us has no stake in the outcome. Our QA process audit is a fixed-price review of how your team tests, from requirements to release. We read your tracker, tests and pipeline, talk to the people who do the work, and deliver written findings with a plan in priority order. Because it works from your tracker, tests and pipeline, it can run remotely.
Frequently asked questions
Where this comes from
ISO 19011:2018, Guidelines for auditing management systems. ISO 9001:2015, Quality management systems: requirements, clause 9.2 (internal audit). International Accreditation Forum, IAF MD 4, Use of information and communication technology for auditing/assessment purposes. IEEE 1028-2008, Standard for software reviews and audits. ISTQB, Standard glossary of terms used in software testing.
Want your QA process looked at?
Tell us how your team tests today and what made you ask. We reply with a scope and a fixed price in writing.
Book a call QA process audit
