Six Tips for Internal Audit to Remain Resilient in the Face of the Coronavirus Pandemic

Guest Blog
As the situation regarding coronavirus (COVID-19) continues to deteriorate, we see businesses becoming stretched and challenged on multiple fronts. From the massive impact on supply chains, to staff availability, to a plunge in demand for products and services in hospitality, transportation, energy, and many other industries, the pandemic is proving to be a real test for businesses and their disaster recovery and continuity plans.

While some are calling coronavirus a “Black Swan” event, others have cautioned preparedness for this kind of occurrence for years. And there are many precedents, including SARS in 2003, swine flu (H1N1) in 2009, MERS in 2012, and other outbreaks of infectious diseases. Indeed, long before the outbreak, business continuity and business resilience featured prominently on several lists and surveys of top risks and areas of concern for 2020. (It’s almost as if some internal audit chiefs had a crystal ball.)

Little more than three months into the year, we’re now seeing why it was one of the top priorities and areas of concern for internal audit teams this year. And while audit teams may be hard at work assessing the entity’s business-wide continuity plans, have they actually taken the time to focus on their own processes and audit team continuity plans? The coronavirus has the potential to be massively disruptive to internal audit activities, which often involve travel, on-site field work, and lots of human interaction. So keeping internal audit up and running will take some planning, some creativity, and some hard work.

In situations like this, internal audit resources can become stretched thin. As we continue to deliver on our audit plans, it’s highly likely we will increasingly be pulled into any coronavirus related discussions. Our unique position within the business means we’re a great touch point for the senior executives to question current processes and controls for various areas of the business, as they deal with disruption.

Internal auditors also have established relationships throughout the organization, meaning they can help facilitate and ensure any required action is implemented. Our unique position in the business may cause some lines to become blurred for any auditor. Where previously we would not want to necessarily be involved in the decision making, here it may be necessary for us to take part in forming solutions. When situations like this arise, it’s important for us to remain objective, risk focused, practical, and valued. Audit shouldn’t be seen as a road block, but rather, a trusted advisor that is bringing to the table a way of thinking which is practical, yet considerate of the risks and our businesses risk tolerance levels.

So while we are busy assisting with coronavirus discussions and business continuity planning, how do we ensure that our own internal audit activity is not significantly impaired? Below is a list of activities or suggestions which internal audit teams can undertake to ensure they remain resilient in the face of the coronavirus outbreak.

Six Internal Audit Coronavirus To-dos
1) Ensure technical capabilities are performing properly: Simple tasks such as ensuring team members have the ability to work remotely, VPN access is working, and documents are placed in the cloud (such as OneDrive or Google Drive) are the basics which can sometimes be overlooked. Most organizations already have features such as Teams, OneDrive or Google Drive available which can be accessed should VPN services become unavailable. Ensuring working papers are maintained on the cloud can help avoid disruption should audit team members need to work remotely.

2) Review the annual plan: Particularly where auditors may need to work across locations, review the plan to see what audits can be performed remotely or which ones can be deferred. As internal audit becomes drawn into COVID-19 discussions more frequently, it may be worthwhile to defer less critical audits and free up available resources to assist the organization with its business continuity planning. Risks change rapidly during a crisis. With supply chain disruptions and major market upheaval, chief audit executives will want to ensure that their teams are still focused on the right risks and providing assurance where it is most needed.

3) Review audit team structures: Where entire internal audit or IT audit teams are geographically located in one area, it may be worthwhile to separate some team members. For instance, splitting teams into two and placing them on separate floors within the office or even separate buildings may reduce the risk of losing an entire arm of your audit team should there be an outbreak in your office. Similarly, where an audit currently has a large number of team members, it may be worthwhile to reduce the number of auditors on a particular audit, extend the audit time frames, and ensure there is enough separation so that an entire team doesn’t become compromised. It’s also important to remind internal audit team members to stay home if they are feeling well or think they may have been exposed to someone who has the coronavirus.

4) Review your audit approach: Whilst most teams are likely already using Skype or Teams to have remote meetings, this can also been seen as an opportunity for us to try new techniques and approaches. Where possible, audit teams may wish to undertake more in depth and detailed analytics rather than placing reliance on traditional walk throughs and controls. Encourage a ‘safe to fail’ environment and allow audit teams to try new things or investigate a work-around where traditional face-to-face meetings are not available. It may also be a good time to encourage internal audit team members to undergo online training to increase capabilities while working remotely.

5) Bring in guest auditors: Where audit teams are geographically separated, it may be worthwhile to share resources across teams within your current office. For instance, if your IT audit team is located in another office and cannot travel, consider using IT team members based locally to assist with your audit processes. This is an opportunity for both audit teams and the broader business. For audit teams, it provides an opportunity for auditors to learn new skills, but to also educate others on the audit approach; what we look at and why we look at it. For business areas, it can help them to better understand the role and purpose of audit. It can also help embed an audit mind-set within business units.

6) Maintain good and regular communication: As priorities change and resources move, it is important that we keep both management and auditees up to date on that activities of internal audit. Where an audit needs to be deferred or time-frames revised, it is important that we communicate this to relevant stakeholders. Not providing good and regular communication can result in us having to field more questions, taking up already valuable time and resources.

These are only a few suggestions on how to remain resilient as an audit function during these challenging times. Above all, it is important that audit teams remain agile and flexible as it is likely that team members will need to be moved and priorities changed at short notice. Practice safety and use caution at all times. 

My Audit Spot is website created to encourage collaboration across internal auditors through the sharing of tools, knowledge, and resources; ensuring audit remains a trusted and respected profession.