Covid and your Internal Audit Annual Plan.

Top 5 things to consider when building your Internal Audit Annual Plan as a result of COVID-19

2020 has been a year for the history books and something which we will all remember for a long time to come. However 2020 isn’t over, and Covid looks like it could well be joining us in 2021, meaning the ride isn’t over yet. This also means, audit needs to plan appropriately for 2021.

With most audit department’s (who run to a calendar year), likely holding stakeholder discussions and preparing their annual plan for 2021, now is the time we need to seriously consider the impact Covid has already had on the business, and what impact it will have going forward.

We discuss below 5 key things you need to consider when assessing the impact of Covid and how you respond to it in your annual plan for 2021.

What business functions have been impacted by resourcing and finance constraints?

For businesses heavily impacted by Covid where staff have been furloughed and budgets cut, it is likely that some processes are likely to have changed and some controls bypassed or no longer operational.

It’s important to review these impacted areas and essentially determine which ones are most impact. Which one’s have no or minimal controls in operation? Which one’s have stopped performing processes due to lack of staff? How many of these processes or controls are critical to the business?

Add these critical processes and business areas which are most impacted to your Annual Plan short list.

What parts of the business are regulated?

Where a business has reduced staff and cut budgets, there will be increased pressure on staff to complete the job at hand and as such, there may be an increased risk that minimum standards and regulatory requirements are not being met.

Audit teams should seek to understand who is ensuring and monitoring regulatory compliance, what monitoring is performed and what issues (if any) there have been.

What has changed in the company’s strategy?

Audit teams should understand what changes (if any) have been made to the company strategy and how this has impacted on business processes. If businesses are in survival mode, than what has happened to the strategy and all the work completed? Is it on pause and any business knowledge or work performed now lost?

Alternatively, is the strategy still forging ahead? If so, how has the strategy adapted as a result of Covid? How are we monitoring progress against the new strategy and is everyone singing to the same song?

Understanding the strategy and where it is at will be essential in shortlisting areas for audit activity.

What is our fraud risk?

With so many pressures facing management and the wider team, there may be incentive or temptation to push the boundaries to benefit the business. Whilst this, in part, links back to our earlier point re controls and critical processes, it should be remembered that fraud does not just occur within the finance team or evidenced through the company’s accounts. Sales reps may be fraudulently pushing through new sales, suppliers may be taking advantage of the business and / or management may be creating culture pressures or an environment where unethical practices are being accepted.

Audit should be the eyes and ears of the business and should have established enough good relationships throughout the business to identify where or when undesired practices are being performed and allowed.

What’s the future of audit look like?

When building our 2021 plan, audit needs to consider the following. Are we going to be retrospective looking, and provide assurance over critical processes and what has occurred over the past 12 months, or are we going to be forward looking? Are we going to acknowledge where there are known issues, but challenge what is being done to address these issues and prepare the business for the future?

Internal Audit will certainly have to consider a lot of factors when developing their 2021 annual plan, and the impact of Covid should certainly be at the forefront of their considerations.

For further guidance and thoughts on other areas to consider, BDO has released a really helpful report; showing what should be considered and how to respond to these. You can view a copy of the report here.