As most companies are experiencing a partial or full lock-down of their day-to-day operations, Internal Audit is also being impacted by these new circumstances.
It is therefore crucial for the Chief Audit Executive (CAE) to revisit the strategic audit plan and re-assess the potential impact that the pandemic situation has on business operations, corporate governance as well as the control environment and finally, on the IA function and the team itself.
Above all, the health and well-being of the IA staff needs to be secured. By now, all internal auditors on assignment abroad should have successfully returned home and – depending on the country visited – on a self-imposed quarantine leave for 14 days. Furthermore, the IA function should ensure that in case of a partial or full lock-down that all IA staff has adequate means to work from home (i.e. laptop, screens, connection). In cases where a longer period of home office has already been introduced, the CAE should ensure that a continuing exchange between the team is ensured, i.e. by providing periodic newsletters on the current situation, introducing weekly conference calls with the entire team or by having bilateral exchanges with the IA employees on a semi-daily basis.
In addition the CAE should re-evaluate the emerging risk conditions of the business and compare the new situation with the current strategic audit plan. What was perceived as being important and relevant in terms of risk half a year ago might have very well been replaced by new, emerging risks that developed as part of the pandemic crisis. Emerging risks could for example include:
New organizational regime:
Liquidity and financial management:
Based on such examples, the CAE should thoroughly reassess the strategic audit plan in terms of 1) feasibility, 2) practicability and 3) usefulness of the scheduled audit missions.
1) Feasibility: Assessing if, for example, audits that include travel to foreign countries can still be executed as scheduled due to temporary travel bans imposed, inability to use transportation means (i.e. cancelled flights) or closed borders at the destination.
2) Practicability: This relates to the questions of certain audit topics that may require extensive process walkthroughs, on-site interviews and the review of physical documentation and whether these are still effectively and efficiently possible when the organization is in lock-down mode and potential interview partners are not at the office.
3) Usefulness: The CAE, in close alignment with Executive Management and the Audit Committee, should assess whether certain audits should be deferred from a risk perspective as they may no longer pose an imminent threat to corporate governance or cause a failure of controls.
In addition to this assessment, the CAE should furthermore evaluate the organization’s current corporate governance and internal control framework and how the pandemic situation might impact its effectiveness. In cases of a partial or full lock-down of office premises, business operations become virtual, requiring more conference and video calls as well as email correspondence.
Whether intentional or unintentional, this may also trigger the circumvention of controls, softening of segregation of duties principles or overriding usual approval procedures. Deviations from the business-as-usual mode and the potential rationalization of resources usually result in a lower level of control, which, together with an increased pressure in terms of time, costs or delivery, could create opportunistic behavior by individuals.
It is important that CAEs with their in-depth knowledge of the organization, processes, controls and culture can accurately assess the potential risk of fraud and accordingly, reassign IA resources to a more preventive monitoring of corporate governance and control effectiveness. Some questions that should be addressed are:
Once the CAE has a clear understanding of the priorities for the coming weeks and months, the plan should be aligned with Executive Management and ideally formally reapproved by the Audit Committee. Following the green light, the CEA should assess how to put the plan into action, that is, evaluate for each audit the following options in regards to the field work needed:
In order to ensure the right response of the IA function and particularly the Chief Audit Executive (CAE), this emerging pandemic situation needs to be thoroughly examined and assessed how it will impact the strategic internal audit plan. CAEs should first ensure the safety of their staff and at the same time re-evaluate their audit plans in terms of feasibility, practicability and usefulness. Furthermore, new emerging risks that are linked to these extraordinary circumstances need to be taken into consideration. By doing this, CAEs together with their teams can play a vital role in ensuring that the organization will master this situation in a more effective and efficient way.
Download the content as a Factsheet.