The correct answers are B and D .
B is correct because, during remote or virtual auditing, the auditor must respect confidentiality, information security, privacy, and auditee permissions. Recording people, taking screenshots, or capturing documents should only be done with permission from the auditee. This aligns with audit principles such as confidentiality, professional care, and information security .
D is correct because auditors should use a combination of audit methods to obtain reliable audit evidence. Audit methods may include interviews, observation of activities, review of documents and records, sampling, remote communication tools, site tours, and review of environmental performance data. Using more than one method helps verify evidence and improves audit confidence.
The other options are incorrect:
A is incorrect because virtual audit evidence is not limited to human interaction. Evidence may also be collected through document review, records, photographs, video, data systems, monitoring reports, permits, procedures, and other non-interactive sources.
C is incorrect because audit sampling methods are determined by the auditor or audit team based on audit objectives, scope, criteria, risk, and available evidence. They do not need to be agreed by the auditee, although the auditee may need to provide access to relevant information.
E is incorrect because auditors are not automatically entitled to take copies of procedures or records off-site. Taking copies depends on confidentiality rules, certification body procedures, legal restrictions, and auditee permission.
F is incorrect because audit evidence from top management interviews still requires verification where possible. Interview evidence should normally be corroborated using records, observed practices, objectives, environmental performance data, compliance obligations, or other audit evidence. Top management status does not remove the need for verification.
Therefore, the two true statements are B and D .
