COVID-19 has disrupted most business areas and functions, including internal controls management. But the right combination of risk management, scoping, testing, and technology can help audit teams navigate these disruptions.
Since business processes have had to change in response to COVID-19 and previously stable business areas are now experiencing volatility, risk assessments now need to be more expansive. And at the same time, auditors may struggle to get assessment and testing done, thanks to work-from-home mandates, technology challenges, and swift, unexpected budget cuts.
What to do:
- Increased Communication -Audit teams will need to consult with more parts of the business, to ask questions and hear their concerns. Communication is key. For financial reporting, audit teams can take cues from securities or audit regulators, who have published lists of high-priority concerns for financial reporting, and then cross-check those with the business unit to make sure they’re aligned.
- Go back and reassess everything – Internal audit needs to revamp its fraud risk assessment. Any process that could be vulnerable to fraud (even at low risk) should be examined. Ask: “How has this process changed because of COVID-19? Are we at greater risk because a fraud control is weaker or absent? Is there new risk, because we are providing a new product or service?” Depending on the results of that assessment, the audit team will need to push for new controls to address the changed risks. For example, tighter limits on wire transfers, or chain-of-custody checks for physical inventory.
- Lean on Technology – The best answer here is for the audit team to use technology that assigns responsibility for testing or managing controls to specific people. As visiting the audit site would not be an easy task now, so the auditors should consider relying on technology for conducting of the Internal Audit. Above all, audit leaders will need to seize the opportunities that present themselves. The evolution toward more collaboration with the business and more innovation in technology has been a long time coming.
- Consider an Agile Audit Plan -COVID-19 is causing organizations to adjust business operations and plans rapidly, presenting new ongoing challenges. One of those challenges may be to conduct auditing entirely remotely. The traditional audit plan might not work in this situation, so it might be time to investigate an agile approach, agile can be an ideal audit approach while COVID-19 risks and priorities shift quickly, and remote audit teams use technology to stay better connected.