Which statement best describes a virtual assessment?

• A. Third party completes questionnaire
• B. Assessor reviews online or other documentation and may require video of physical controls
• C. On-site testing is mandatory
• D. Only public records are used

Answer: (B)

A virtual assessment is about evaluating controls remotely by reviewing evidence that exists online or in electronic form and, when needed, verifying physical controls through video. The best description aligns with having the assessor examine online documentation and potentially observe through video to confirm how controls operate in practice, without requiring a physical visit. This approach leverages digital records, interviews, and video demonstrations to gather sufficient evidence of control effectiveness from a distance.

Relying solely on a completed questionnaire would be more like a self-assessment, not a remote auditor’s evidence-gathering process. Requiring on-site testing would contradict the idea of a virtual assessment, since the assessment would be conducted remotely. Using only public records would miss internal evidence and direct verification of how controls function in the organization.