COVID -19: How should Internal audit respond?
May 06, 2020
Managing risks and uncertainty has always been the hallmark of Internal Auditors across the world. We have always kept the business aware of the possible risk scenarios which it may face in the future. This Black Swan COVID-19 has hit the world with great speed and has a widespread impact. Internal Auditors around the world are faced with some unique situations. Some queries which come to the mind of Internal Audit (IA) Heads are:
1. What role should the Internal auditors play in the current situation?
As Risk professionals, Internal auditors are in an advantageous position to provide detailed insights to senior management regarding the impact on organizational risk and opportunity landscape. Help stress-test operational risks and potential vulnerabilities in light of COVID-19. You can proactively review or develop the Business Continuity program. Identification of critical business processes and the required inputs to sustain them will also be helpful to ensure all key controls are working. Discuss with senior management to understand any vulnerable areas (like supply chain, contracts, reputation, etc.) which may require immediate attention. It is probably not an ideal time to stick to your audit plan if it does not provide immediate value for the organization. It might be more beneficial if Internal Auditors temporarily focus more on their risk advisory role.
2. Is my audit plan comprehensive to cover the COVID 19 / post COVID 19 scenario? Do I need to revisit my Risk Assessment to cover the new changes in business processes and the associated risks?
There are many associated risks which are impacted by COVID-19, for example: Cyber and Fraud risks, Reputation risks, Supply Chain risks, Health & Safety, to name a few. Many processes have undergone substantial change hence reviewing them based on Pre-COVID 19 risks may not be appropriate. Evaluate the emerging risks of newer operating models and business practices and redirect your attention to the most time-sensitive risks. Risk probability and impact may have changed due to the changes in the operating environment and other Macro / Micro economic factors. It is advisable to reassess the Internal Audit plan to ensure it is up to date with the current risk factors and with updated risk ratings.
3. Would I be able to timely complete my annual audit plan timely? Which audit assignments can be effectively completed remotely?
Due to the remote working environment, travel restrictions, limited access to assets, etc. audit teams are facing difficulties in effectively performing all the audit procedures which are required to satisfactorily complete the audit. It is recommended to prioritize the audits which can be completed remotely. You need to identify and prioritize projects which are mandatory from a regulatory reporting perspective. The completion timelines of the complete audit plan should be revised. Communicate how you are changing your audit plans to the Audit Committee and Senior Management. Be transparent about the limitations currently applicable.
4. Is my team equipped with the right tools and technologies to handle “work from home”? Do we have adequate information security protocols to ensure seamless flow of information through the internet to enable remote working?
It’s the need of the hour to test new and innovative ways to connect with your customers, vendors and employees. IA teams need to use centralized data sources, cloud servers, online meetings, video surveillance, Digitized records, etc. wherever applicable. Understand and review the Information Security framework implemented by your organization. Test its resilience in the current scenario. Discuss digital transformation ideas with the IT head and assess if any help is required. You will need to encourage innovation through flexible new ways of working to the degree your business can support this.
5. How can we do effective performance management in the “work from home” scenario?
Use Attendance tracking, Timesheets, Dashboards or Productivity measurement systems commensurate with the size of your organization / team. Recommended to have a periodic call with the full team ensure a common understanding and goal is in place. Communicate effectively with the team to identify and resolve any issues. Plan virtual team-building and socializing activities the same way you would in the office. Set aside time to catch up on each other’s personal lives. If the team has some excess time on hand, then the same can be used to upskill them using numerous online courses available. Internal webinars are also a good way to share knowledge on some specific areas.
6. How to use the COVID-19 Pandemic to promote Risk Culture in the organization?
IA professionals can actively take up the role ensuring that the organization is more risk aware and risk management practices are clearly defined and understood. They should strive to integrate risk management with business planning and strategy (Alignment of Risk appetite and strategy and better articulation of Risk appetite i.e., the Risk to take and Risk to avoid). Enhance organizations’ ability to drive more real time Risk management activities which would instill greater confidence in the Board/senior management in Risk management capabilities.
Yes, we are in difficult times, but internal audit’s potential contribution can be enormous: helping to provide a trusted risk perspective during the current crisis when critical risks are both rising and changing quickly. While articulating your response, keep in mind the medium and long-term objectives. We are all anticipating a “New Normal” at some point in future, which will be different from pre COVID-19 normal. If internal audit delivers critical direction now, while also preparing for the future, it will emerge as a formidable team, providing greater value to the business.
Designation: Partner – Risk Advisory, MBG Corporate Services, UAEAbout Author:
Partner – Risk Advisory, MBG Corporate Services, UAE
With MBG’s Internal Audit services, we can help your organization to effectively manage the new risks the business may be in. Get expert guidance on strategizing for the new normal. Feel free to get in touch with us.