How Internal Audit Leaders Are Responding to the Current Crisis

These are strange days.

Many of us may feel like we are living out a dystopian movie as we walk around the neighborhood waving to neighbors, but knowing we can’t stop to chat and must keep at least six feet away. Grocery shopping has become an act of courage, and we must wash our hands after bringing in the mail. We are confined to our homes most of time and see our friends and extended family only over Zoom video sessions. Some people may feel bored, with work slowing down, or are focusing on at-home hobbies, unable to work remotely.

Like others, internal auditors are spending the better part of the day in their pajamas. But don’t let the sweatpants fool you; they are all business. In fact, while others are slowing down, internal auditors are shifting into high gear to meet the onslaught of issues that have cropped up as a result of the Coronavirus Crisis. They are setting up calls with board members, weighing in on new employee policies, and rethinking what risks are most pressing to the business.

A recent survey by the Institute of Internal Auditors’ Audit Executive Center finds that internal auditors are very busy dealing with the impact of the pandemic on their organizations. The survey of 170 chief audit executives and directors finds they are focusing their coronavirus response on assessing the short-term impact of the pandemic (78 percent) and communicating with the board (72 percent).

Joshua Hayward, leader of the compliance program and former internal audit executive at EnergyAustralia, says the focus on providing reassurance to the board is well placed. “One course of action is to commence a COVID-19 response assurance program. The objective being to provide assurance to the board that the activities management are undertaking to respond to the COVID-19 crisis are effective,” he wrote in a recent post on LinkedIn.

Coronavirus Focus Areas
Strategic Imperatives: In addition to the above-mentioned tasks of assessing the short-term impact of the pandemic and communicating with the board, internal auditors say they are also revising business continuity plans (66 percent), evaluating the impact on third-party relationships (59 percent), and conducting a detailed assessment of the long-term impact of the pandemic, the IIA survey finds.

Employee-focused Initiatives: Organizations are prioritizing the needs of employees in their responses to the crisis, and internal audit leaders say they have been involved in actions that affect employees. The top priority is ensuring that employees are set up to work remotely. A full 96 percent of chief audit executives say their organizations have implemented remote work arrangements. Other employee-related initiatives include developing a communication strategy for key employees (73 percent), restricting travel (67 percent), and adding new technology for remote work and data security (59 percent).

Customer-Focused Initiatives: By far, the most common customer-focused strategy among internal audit respondents to the survey is developing a communication strategy for customers to let them know what they are doing in light of the pandemic (82 percent). Just under half of the respondents (45 percent) say their organizations are developing policies for customer health and safety.

Financial responses: Internal auditors say their organizations are closing offices, factories, retail locations, and other facilities (44 percent), exploring short-term cost reduction strategies (39 percent), and reducing operating hours or capacity (38 percent).

Internal Audit Getting Involved?
The survey also finds that internal audit leaders at bigger companies are more involved in their organization’s response to coronavirus than those at smaller companies. At companies with an internal audit department of 26 or more professionals, 62 percent say their organizations involved internal audit in discussions of risk and potential responses to the crisis. At companies with internal audit departments of five or less professionals, only a third (32 percent) say the organization included internal audit in such discussions in a timely manner.

“While findings about the timeliness of internal audit’s involvement are concerning, the poll also provides data that suggests there are opportunities for internal audit to provide ongoing support through insight and foresight,” wrote IIA President Richard Chambers in a related blog post. “For example, only about half of respondents (51 percent) reported their organizations had performed a detailed assessment of long-term impact, and less than half (45 percent) reported a review of strategic plans with management. Those two areas will be significant as organizations around the world manage the ongoing risks related to COVID-19 and economic turmoil,” he wrote.

Assessing the Risks
Assessing the short- and long-term impacts of the Coronavirus Crisis is probably the biggest contribution that internal audit can bring to the organization during this difficult time. Indeed, a recent report by AuditBoard, a provider of internal audit and risk management systems, advises internal auditors to don their risk-assessment hats as they deal with the crisis. The report put “identifying the key risks associated with your organization’s coronavirus response” first on its list of to-dos for internal auditors.

“One of the most effective ways Internal Audit can support their organization during this time is by performing an impact assessment of key business units, focusing on people, processes, and technology,” wrote AuditBoard’s Anand Bhakta, senior director of risk solutions, and Scott Madenburg, account manager director. “The goal of this assessment is to help the organization assess and prioritize its response strategy based on areas where help is needed most,” the report’s authors wrote.

Internal audit guru, Norman Marks provided some more sage advice on assessing risks during the crisis: “It may not be as easy for internal audit to know its place today, even for the next months, but carrying on as normal is unacceptable,” he cautioned in a recent blog post. “What was identified as the top risk when you did your audit planning and risk assessment—what you are auditing as your read this—is almost certainly not the top risk today. So set your audit plan aside, and ask: ‘How can we help management?’ ” Good advice, for sure.

The AuditBoard report provides some other considerations and imperatives for internal audit leaders as they respond to the crisis, particularly related to updating the business continuity plan. They include:

• Align your policies with existing crisis management and emergency plans, and include a chain of command structure to sustain business operations and communication with employees.
• Decide how to protect critical assets in short supply and how you will deal with possible public panic and disorder, fewer security guards, and strained law and order.
• Take into account which critical items might not be available if the just-in-time supply chains break down.
• Consider how power shortages or lack of personnel may disable normal systems and secure remote-access systems needed for continuing business operations.
• Plan ways to provide timely, accurate, and reliable information to the public.
• Consider how to implement and comply with new mandates, practices, and laws or regulations such as tracking and monitoring employee health.

The to-do list for internal auditors is long and getting longer. Most are likely working extra hours to assess the risks and help plan the organization’s strategy to navigate the crisis. And while our daily routines are disrupted and this dystopian movie seems to be running long, don’t forget to get up every now and then and get out into the fresh air. Don’t forget to wave to neighbors, just make sure you don’t get too close.  

Joseph McCafferty is editor and publisher of Internal Audit 360°