As more Americans receive vaccinations and the rate of COVID-19 cases steadily declines, more companies are planning for employees to return to their offices. Even as they do, work promises to look different than it did before many started working from their dining room tables and basements. Perhaps nowhere is this truer than in internal audit functions. Many internal audit leaders have hit on practices and processes, born out of necessity, that are likely to long outlive the pandemic.
At the top of the list of what some call the “new normal” is a greater willingness to allow staffers to work remotely, as well as conducting internal audit work remotely. A January 2021 survey by PwC found, for example, that less than 20 percent of executives say they prefer a return to the pre-pandemic office environment. That’s not to say they’re ready to jettison offices altogether; almost 90 percent stated an office environment fosters collaboration. Yet, more than 80 percent said the shift to remote work was successful.
As a result, some changes implemented during lockdowns are likely to remain. Many internal audit organizations will continue to conduct meetings and audits at least partly remotely. Some will maintain virtual “water cooler” sessions that connect far-flung employees. In addition, many chief audit executives and other audit executives are counting on the attributes the pandemic brought out in many employees to endure, such as greater agilely and innovation.
Flexible Scheduling
The post-pandemic work schedule likely will include a mix of remote and on-site scheduling, albeit within some constraints. “We’ll continue to offer remote work as an option, as long as senior management allows it,” says Rick Walke, vice president of internal audit and risk management at Forum Credit Union, based in Indianapolis. At the same time, employees will be expected to show up for meetings when needed.
Internal audit employees at Valley National Bank, which operates primarily in the Northeast, will return three days a week, says Jacqueline Breslauer, chief audit executive. On one of those days, all audit employees will be required to commute into the office. The other two days will be determined by client meetings.
The new flexibility is prompting some companies to implement scheduling systems. At gaming company Caesars Entertainment, for example, employees will use an appointment system to reserve places to work, says Karl Stingily, chief audit executive. He estimates that employees will average about half their time in the office. Like other audit executives, he expects everyone will be in the office on certain days for face-to-face meetings or to meet with audit clients.
Virtual Team-Building Events
As employees return to the office part-time, the number of virtual meetings likely will drop—but not to zero. Virtual meetings have proven to be an effective way to connect far-flung audit personnel, say internal audit leaders. Phil Benvenuti, senior director of internal audit at Pegasystems, has maintained fifteen-to thirty-minute virtual check-ins about once a week. These allow employees dispersed across the globe to get to know each other better. “They have been great for camaraderie,” he says.
More informal communications and non-work-related virtual get-togethers will also likely continue, say audit leaders, due to their team-building benefits. Benvenuti or a colleague, for example, often will send a question for discussion—say: “if you had a month off from work and an unlimited amount of money, what would you do?”—in advance of the meeting as an ice breaker. Employees participate to the extent they’re comfortable. “The meetings have allowed us to get know each other better and demonstrate more empathy and support for those who have been adversely impacted by the pandemic,” he says.
The global audit team at Molson Coors Beverage Co. participates in a global, virtual team meetings about once a month, says Linda Milburn-Pyle, chief audit executive. While the meetings are social, a facilitator helps conduct them. “The virtual environment requires someone to drive topics and make sure everyone is included,” she adds.
At Valley Bank, virtual meetings have been so successful they’ll actually replace business phone calls, Breslauer says. While some face-to-face meetings will return, both conference calls and one-on-one calls will be replaced with virtual get-togethers. “Phones are going away,” she adds.
Internal Audit Goes Digital
Like many other functions, internal audit will continue to incorporate more remote and electronic work, including conducting remote audits. “About eighty percent of our audits can be done from anywhere,” Milburn-Pyle says, adding that some work will continue to be done remotely.
At Forum, Walke and his colleagues are using Zoom and other virtual tools to complete process mapping, among other audit steps. For instance, rather than driving to a branch to learn how it opens a commercial checking or savings account, the auditor and auditee can connect via Zoom. “It’s not something we would have done about a year-and-a-half ago,” Walke says, adding that it’s both an efficient way to exchange information and typically allows more people to participate.
The pandemic helped expedite a focus on innovation at Valley Bank, even as the bank continues to work within its risk appetite, Breslauer says. She and her team have begun using more electronic documents and signatures. “The need to find alternative ways to evidence control execution will continue to be a standard practice,” she says. This is another shift that boosts efficiency. Rather than hunt for documents in physical file cabinets, auditors can look through a shared computer drive, Breslauer says.
Working with electronic files also cuts email volume, says Milburn-Pyle. If several people are working on a document, they all can edit within the document or create a group chat to discuss questions, rather than hash them out over extended email exchanges.
The ability to connect virtually is “drastically reducing field time for auditors,” says Stephen Young, vice president of internal audit and chief compliance officer at manufacturer MacLean-Fogg. By conducting opening and status meetings virtually, the time auditors spend on site likely will shrink from about two weeks to two days, he says. The auditors’ time on-site will be “very focused” on the activity, like an inventory cycle count, that can’t be handled virtually.
With the need for cloud-based solutions to facilitate remote workers, many internal audit functions have sped up plans to adopt internal audit platform. Such tools have added benefits that will continue well past the pandemic’s end. For example, electronic tools allow internal audit to review entire populations, rather than samples, Young says. When assessing the purchase-to-pay cycle, for instance, his team can look at the entire universe of purchase orders and then zero in on any outliers. Because they’re now looking at a complete population rather than a sample, the auditors can confidently say “the controls are working, with these few exceptions” he adds.
When more of the audit process is handled remotely, the audits themselves tend to extend for longer periods of time, Young says. “You’re not there in person, so there’s less urgency.” In response, he and his team keep more projects going at the same time. That way, the audit team can fit their activities into their clients’ schedules, without getting behind themselves.
Establishing Relationships, Managing Security
This isn’t to suggest more virtual work or remote audits are an unqualified positive, or that all internal audit work will proceed remotely. Face-to-face exchanges remain critical, especially in certain circumstances. Conducting interrogations is more effective when an auditor can talk to an individual in person and observe their reactions and body language, Young says.
Auditors note that working together in person helps foster collaboration and build relationships, which can be especially important when an auditor must issue a less-than-favorable report. “In internal audit, you have to fill the well before you can take out of it,” Milburn-Pyle says. Auditees may be more willing to accept the finding of a deficiency when they’ve built a relationship with the auditors.
Remote work also can increase cyber risk. When working from home, employees often mix work and personal activities on their work computers, potentially exposing the organization’s network. The number of cyberattacks, for example more than doubled during the pandemic, a May 2021 report by HP Inc. found.
As a result, internal audit departments are adjusting their approach to cybersecurity. Cybersecurity audits at Caesers, for example, now include a greater focus on remote connectivity, Stingily says.
Assessing Health and Safety
Stingily also obtained senior executive buy-in to conduct health and safety audits at each casino upon reopening. “This was clearly one of our top areas of risk and it was important that internal audit play a proactive role,” he says. He and his team developed detailed audit plans covering 50-some areas and regulations, including the availability of sanitizing supplies when customers enter a facility and detailed instructions for cleaning dice. Such health and safety audits are likely to become more common in the wake of the pandemic, as organizations rework business continuity and disaster recovery plans to be more accommodating to such disruptions as widespread illnesses and contagions.
Pegasystems is rolling out an online training module to reinforce security practices in a remote environment, Benvenuti says. All employees will be required to take it when hired and annually. The goal is to communicate the safety measures required when working remotely, like making sure to sign in through the virtual private network.
Hardware asset management also will receive more attention, Milburn-Pyle says. Because the pandemic-induced shift to remote work occurred so quickly, it was difficult to consistently employ scrupulous asset management practices regarding, for instance, laptops and monitors. “Going forward, we’ll need to track these assets more closely,” she adds.
The pandemic also prompted changes too, as well as a greater appreciation for business continuity planning, Breslauer says. “While it’s a playbook we hope never have to use again, going forward, we’ll ensure our business continuity plans include pandemics.”
Greater Agility and Innovation
Ideally, even as work life returns to some version of normal, many hope the innovative spirit that many employees brought to their work during the pandemic will continue. Employees at Valley National Bank were “almost forced to utilize agile methods” to quickly establish an effective approach to processing Paycheck Protection Program loans, Breslauer says. “The bringing together of subject matter experts from many disciplines, including audit, to quickly solve a problem and develop a successful solution is now the preferred approach to solving issues in many departments,” she says.
“What I found so heartwarming is the resilience with which my audit team and our bank rose to the occasion,” Breslauer says. “We proved we could pivot, change, and adapt, and we came out stronger.”
It’s no secret that many internal audit functions were caught flat-footed by the pandemic, just as nearly all facets of business and private life were. And the human toll of the COVID-19 pandemic won’t soon be forgotten. Still, as internal audit functions moved into survival mode, many hit on practices and processes that improved how they do things. That lasting legacy may hopefully be the silver lining in the devastation that the pandemic has wrought. 
Karen Kroll is a finance and business writer based in Minneapolis, Minnesota.