Auditing at Home: Addressing the Challenges of a Remote Internal Audit Workforce

One of the things we will all remember long after the Coronavirus Crisis is over—apart from the horrible loss of life, of course—is the extended period of everyone working from home. We’ll remember the kids and pets making appearances on Zoom calls, scoping out the items on everyone’s bookshelves in the background, and Dave from IT’s funky pajamas.

As the stay-at-home orders due to the COVID-19 pandemic are extended from weeks to months, internal audit leaders are grappling with the challenges of completing their audit plans and other internal audit functions with a completely remote staff.

They are working to figure out ways to securely and reliably connect with employees and executives; to keep audit projects moving and everyone updated on the current status of required work; to access information typically obtained through on-site observation and human interaction; and to access the new risks the Coronavirus Crisis has surfaced.

Internal audit executives are navigating these challenges. They’re using video-conferencing and file-sharing tools to remain connected and manage work remotely. Some are leveraging technology to conduct virtual audits or portions of them. Where necessary, audit leaders are delaying audit work that would interfere with the new demands of the pandemic and prioritizing critical tasks. And most internal audit shops are reviewing existing audit plans in light of changing risk profiles.

Setting Up a Remote Workforce
For most internal audit leaders, setting up their department to work remotely was a first step. A poll taken in late March by the Audit Executive Center of the Institute of Internal Auditors (IIA) found 96 percent of internal audit respondents had implemented remote work arrangements for their employees.

Planning is critical, says Brad Rachmiel, managing director and internal audit expert at consulting firm, Protiviti. “Understand who needs to be online and whether they have the right platform.” That’s especially critical in countries where Internet connectivity is less reliable.

The internal audit team at Northern Arizona University worked with the university’s IT department to test remote capabilities for the three-member department, says Mark Ruppert, chief audit executive, just as the crisis was hitting. This included testing the speed at which employees could connect to the virtual private network (VPN), the robustness of Microsoft Teams for video-conferencing and file-sharing, and the efficacy of the two-factor authentication process. This all occurred before employees began working from home. “All were in good shape,” he says. In addition, employees have been instructed to log in from their university laptops, which are encrypted, rather than their personal computers, he adds.

To be sure, conducting all business virtually can pose many security concerns. Some videoconferencing software has security shortcomings, such as a lack of end-to-end encryption. For many meetings, this may not matter, so long as employees know not to discuss sensitive information. Employees also should be able to use a secure file-sharing application, so they don’t have to share sensitive files during the meeting itself.

Many team are using Zoom to facilitate video calls. While the platform scores high marks for its ease of use and lots of features, some experts caution that it has some security flaws that have come to light during the last few weeks. Indeed, during this week alone reports surfaced that Zoom account credentials were being sold in bulk on underground online markets.

Prioritizing Audits Based on COVID-19 Activities
Once Ruppert’s team was up and running remotely, he adjusted the audit plan to minimize interference with activities in client departments related to COVID-19. Some testing related to an audit of IT access management was delayed for several weeks so IT could focus on ensuring enough bandwidth that all online teaching tools could meet the spike in usage. “All of a sudden, 30,000 students would be online,” he says.

Similarly, remote fieldwork for a financial aid audit was delayed to provide time for the department to work through financial aid issues related to the pandemic, among other issues. It’s now tentatively set for May.

In the interim, Ruppert’s team is preparing for a planned shift later this year from its current audit administration system to a solution that combines Sharepoint and Microsoft Teams. His department is using this time to get up to speed on the new solution. “The delays in the audits provide time to dig into this,” he says.

Many internal audit director are building cushions into their audit schedules to reflect the time management must now devote to activities related to the pandemic, says Rob Frattasio, partner with accounting firm RSM US LLP. Others are delaying an audit or two, freeing up capacity to accommodate the inefficiencies of working remotely, even with technology connecting everyone, he adds.

Some internal audit teams are working to push through with existing plans. As of early April, the internal audit team at Fossil, a maker of watches and accessories, was planning for Sarbanes-Oxley compliance. “For us and other companies impacted by the virus, it will have a financial impact that will have to be addressed,” says Stephen Shelton, chief audit executive. Their work “hasn’t skipped a beat,” though, says Shelton, thanks to electronic calls and meetings with external auditors and other stakeholders.

Adjustments to Work and Communication
Some internal audit leaders worry that with their teams working from their own homes rather in in-person groups, teamwork and creativity will suffer. Remote work arrangements change how audit leaders can communicate with employees and colleagues and how team members communicate with each other. Spontaneous conversations are almost impossible and the solutions that were the product of water-cooler chatter aren’t going to come about that way.

“Have a standard communication schedule to keep people up to date,” Rachmiel says. In addition, he urges chief audit executives (CAEs) to establish accountability within their audit teams. “Make sure you know who’s doing what.” One way to keep auditors focused, even with the distractions of working from home, is to break audits into “sprints,” or tasks that take a week or two to complete, he adds.

At software company Pegasystems, Phil Benvenuti, senior director of internal audit, keeps team members informed about what’s going on in different regions, and helps them feel connected to one another and the company through online meetings scheduled as needed. He also schedules 15-minute all-team video calls every few days. “We keep it very light and informal,” Benvenuti says, adding that it’s one way to check on everyone’s health, how they’re managing isolation, and any other challenges team members are facing.

To compensate for the loss of internal auditors embedded within legal and finance—“you learn a lot about what is going on during those informal ‘water cooler’ talks,” Benvenuti says—internal audit regularly checks in by instant messaging or with quick phone calls. “It helps us to stay connected,” he says.

Some internal audit teams are also looking for informal ways to keep auditors feeling like part of a team and to keep bonds from breaking down while employees work in their separate homes or apartments. Some are conducting video-conferenced “happy hours” or group exercise sessions. Benvenuti, for example, participates in a cross-department “pushups club” that meets—now virtually—on Friday afternoons for twenty minutes. “It’s a good break and a bit of a stress reliever,” he says.

“People are getting creative,” Frattasio says. One client is using Facetime, a video phone app for Apple products, as a “virtual pop-in,” and informal chats. It’s a little more casual than a scheduled virtual meeting, he adds.

Balancing Work and Home Life
Some internal auditors working from home now also have to handle childcare responsibilities. While nobody seems to have found a silver bullet, many organizations are allowing employees some flexibility in their work hours, Frattasio says.

In addition, the idea that kids and pets need to be out of sight during video conferences seems to be gradually disintegrating, Frattasio says. For some employees working from home with their children underfoot, it’s simply too difficult to arrange a child-free call. Instead, it’s no longer unusual to see kids sitting on employees’ laps while they talk. “We’re going to a new normal,” he adds.

Limitations of Remote Work
While technology can overcome many challenges of remote work, many hurdles remain. The 150-plus branches of Mobile Mini, a provider of portable storage units, have been deemed “essential,” so employees remain on the job at those locations, says Brendon Friedman, director of internal audit.

While internal audit is working remotely, one auditor handles branch audits and normally travels each week to review operations at a different branch. Grounded due to the pandemic, she’s been completing projects that had been on the back burner, while also conducting audits that are reduced in scope. One modification that Mobile Mini internal auditors are making, for example, is that they’re not issuing formal scored audit reports.

These audits aren’t mandated by any regulation, so the company could defer them for some time, Friedman notes. However, because his department strives to add value, it’s continuing with the more limited audits. Friedman and his team also are thinking of ways they can perform full or somewhat limited branch audits if the travel restrictions extend into the longer term, he adds.

At Northern Arizona University, Ruppert says he may combine video conferencing technology with assistance from employees in the client departments for future audits that require onsite observations or interactions. For instance, if an auditor can’t visit a construction project, he or she might work with the relevant expert to virtually tour the project using video technology and gain an understanding of the asset, he says.

To be sure, even with technology, a virtual audit hampers the ability to assess auditees’ body language, Ruppert says. That could be critical in an investigative or other audit in which body language might give hints as to the truthfulness of a person’s responses. Ruppert’s team isn’t currently working on an investigation, so this hasn’t been a concern. If the work-at-home restrictions continue for the long term, “we will find new ways to deal with it,” he adds.

Job Cuts
Internal audit hasn’t been immune to the job cuts, furloughs, and changes other departments are experiencing, Frattasio says. That’s particularly true in industries hit hardest by the pandemic, such as travel and hospitality, he adds.

Along with the challenges posed to the individuals involved, job changes often alter the way in which internal audit handles its responsibilities. For instance, Miami University in Oxford, Ohio had been using student internal auditors to conduct monthly analyses of procurement card spending, says Barbara Jena, chief audit officer. These auditors had to head home when the university shifted to online classes.

In their place, a full-time auditor reviews weekly activity for any unusual spending and fluctuations, using a macro script to speed the analysis. “This is to help management decide if actions are needed to further control spending with procurement cards during the state of emergency,” Jena says.

Jena also monitors any exceptions to internal controls, such as changes to system access or the segregation of duties, now that employees are processing key administrative functions from home. She provides an example: say one employee is granted broader system access to serve as backup for another employee who becomes sick. The duties may not be segregated as systematically as they had been before. “This may result in a new internal control risk exposure to test until the system access returns to the prior state,” she says.

Internal audit can help process owners “understand not just that the job has to get done, but that it needs to be within a proper control environment,” Rachmiel says.

Changing Risks
Perhaps the most significant change to internal audit resulting from the pandemic is the way in which it’s altering the risks many companies face. “Everyone is re-assessing their risk profile,” Rachmiel says.

In higher education, for example, pressure to boost enrollment might increase, leading to new risks. The reason? It’s likely some students won’t return to school, either because they’re worried about getting sick or they no longer can afford it, Ruppert notes. In turn, that could prompt some to bend the rules on financial aid or athletic recruiting. (Ruppert notes that he doesn’t expect this to occur at NAU.)

While Ruppert’s group currently works from an annual audit plan, he says he’s “keeping an open mind” about eventually moving to a quarterly approach to say on top of changing risks.

When audits are changed or delayed, communication with stakeholders is critical, Rachmiel says. Internal audit needs to talk with the audit committee and management, and make sure they’re on board and understand the ramifications. Internal audit also can use its expertise to aid decisions about deploying resources to best address fluctuating risks, he adds. 

Karen Kroll is a finance and business writer based in Minneapolis, Minnesota.