As the coronavirus pandemic continues to wreak havoc on health systems and economies around the globe, nearly all companies are being affected in some manner and must react to rapidly changing developments. They must consider, foremost, the health and safety of their employees and customers, even while they deal with supply chain disruptions, a plunge in demand for some products and services, and forced closings at many businesses that interact with the public.
Transportation, hospitality, sports and entertainment, retail, energy, and finance have been some of the hardest-hit sectors, but companies in nearly all industries are operating under circumstances that were unfathomable just a few months ago. The coronavirus pandemic is one of the best examples yet of just how quickly a risk can materialize in today’s business environment that can change everything and even threaten the future of companies that were on solid footing just weeks ago.
It is during a crisis such as the current one that internal audit can play a major role in helping to assess risks, advise business units and management on controls and policy changes, and leverage established relationships throughout the organization to manage through the crisis and facilitate new courses of direction. To achieve these objectives, however, internal audit will have to act nimbly and decisively and remain flexible in the face of a rapidly changing set of factors.
The coronavirus has the potential to be massively disruptive to internal audit activities, which often involve travel, on-site fieldwork, and lots of human interaction. Indeed, at most organizations, it already has been disruptive. So keeping internal audit up and running will take some planning, some creativity, and some hard work. Here are five internal audit imperatives to remain resilient and deal with the coronavirus pandemic:
One: Revisit business continuity and disaster recovery plans
It is likely already too late to be creating a business continuity and disaster recovery plan from whole cloth to deal with the current crisis. Companies that have not put much emphasis on such plans or have not reviewed them in ages will be behind the eight ball in terms of managing through the crisis from a shared set of guiding principles. Experts advise these companies to assemble top management, outline priorities and assign responsibilities to key senior managers. Communication—including clear and sensible directives, leadership, and agility will be at a premium for these organizations.
While companies with well thought out and updated business continuity and disaster recovery plans will certainly be in better shape, their work is hardly done. These plans are developed for general disruptions and must be adjusted for the unique circumstances of the coronavirus pandemic. Probably the first to-do for internal audit leaders is to assess these plans and ensure they are adjusted to meet the specific needs of the coronavirus pandemic. “All organizations and internal auditors should prepare for the possibility of a global economic crisis by reviewing their budgets, updating and testing crisis management plans, and considering a reasoned reordering of their audit plans,” wrote Richard Chambers, president of the Institute of Internal Auditors, in a recent blog post.
Two: Review audit team capabilities and work plans
While internal audit teams will likely be called upon to assist in assessing risks and ensuring that organizations are equipped to meet the challenges of operating under the severe strain of the coronavirus outbreak, its important to also assess and manage the continuity of the audit team itself. Most workers in the United States are being asked to work from home, which can be difficult for internal auditors who are trying to conduct an audit out in the field. Every consideration should be made to protect the safety of workers and their families. Some audits that require travel or on-site observation will simply have to be delayed. It’s true too, though, that counting inventory or assessing policy compliance at a far-flung office might not be the best use of internal audit’s resources right now, anyway.
Internal audit team leaders should also review how their teams are structured. Keep auditors from working together in close quarters so if an outbreak occurs it doesn’t wipe out the whole audit team. Internal audit may also want to pull in some guest auditors. A guest auditor from operations who is already located onsite, for example, might be able to help out on audit that would otherwise require travel for regular internal audit team members.
Internal audit leaders should also ensure that technologies are up and running that can assist auditors who must complete their work from home. VPNs, for example, should be tested. Work papers should be saved on shared cloud services, such as Box or Google Drive. And services such as GoToMeeting or Skype should be secured to facilitate virtual meetings.
It may also be a good time for internal audit team members to undergo online training, which can be conducted from the security of their own homes. If internal auditors aren’t able to complete their scheduled work, they can always boost their skills and capabilities with online training.
Three: Help the board and senior management reassess risks
Certainly, the risk landscape has changed. It’s important to reassess risks in light of the current circumstances to refocus the business on what matters most and what could mean the difference, in these difficult times, between surviving or not.
Still, some caution against just focusing on the things that can cause harm to the organization when considering risk, even in a crisis. For example, Norman Marks, risk management guru and author of the blog, Norman Marks on Governance, Risk Management, and Audit, says risk management should be more about focusing on decision making than on what could go wrong. “It’s time to recognize that managing a list of potential harms is not helping the organization make the informed and intelligent decisions necessary for success,” he wrote in a recent blog post on dealing with the coronavirus pandemic.
Marks offers three questions to pose to board members and senior executives during the coronavirus crisis to consider rapidly changing risks:
- When you make decisions about coronavirus, what is your process? How do you make sure you consider all the things that might happen, both good and bad?
- How do you measure your success? As you go through the year, how do you see whether you are on track? How do you assess the likelihood of being successful, considering all the things that might happen?
- Does everybody have your enterprise objectives in mind as they run the business and make decisions? Do they know what they are and how their actions and decisions might affect them?
Four: Re-prioritize the audit plan
What is at the top of your audit plan now is likely no longer related to the top risks the organization faces. A fast but thorough reassessment of the top risks, flowing from the second point on this list, should be conducted, and the audit plan should be revised accordingly. This will require some agility, but internal audit teams that act according to a business-as-usual standpoint will only hasten their demise.
Particularly where auditors may need to work across locations, review the plan to see what audits can be performed remotely or which ones can be deferred. Risks change rapidly during a crisis. With supply chain disruptions and major market upheaval, chief audit executives will want to ensure that their teams are still focused on the right risks and providing assurance where it is needed most.
Five: Boost communication
As priorities change and resources are marshaled to where they are needed, it is imperative that we keep management, audit customers, and other stakeholders up to date on the activities of internal audit. Where an audit needs to be deferred or the time-frame revised, it is important that we communicate constantly to those involved. Clear communication with business units and stakeholders is vital. Communication can often break down in a crisis and we have already seen how misinformation can circulate and complicate the situation. Not providing good and regular communication can result in us having to field more questions, taking up already valuable time and resources. In fact, always err on the side of over-communicating. It will ensure that everyone is on the same page.
The coronavirus pandemic is unlike any challenge that corporate America has faced in the past. With people unable to collaborate in groups, at least for the time being, internal audit will struggle to complete its work. Technology, like cloud services, virtual meetings, and internal audit management systems can help when auditors need to work from home, but internal audit will also need some creativity, perseverance, patience, and understanding to work through the crisis.
The pandemic will be over at some point, but just what shape our organizations are in when it does, will rely greatly on the actions and decisions that are being made right now. Internal audit should play an important role in working through them.