Updated: Mar 13, 2020
6 tips to help your internal audit function remain resilient
As the situation regarding coronavirus (COVID-19) continues to evolve, we see businesses become stretched and challenged on multiple fronts. From impacts on supply chain processes through to staff availability, this is proving to be a real test for businesses and their business continuity plans.
It’s almost as if some audit head’s have a secret crystal ball with both business continuity and business resilience both featuring as a hot topic for 2020. Little more than three months into the year, we're now seeing why it was one of the top priorities / areas of concern for audit teams this year. However whilst audit teams may be concerned about the entity’s business wide continuity plans, have we actually taken the time to focus on ourselves and our own team continuity plans?
In situations like this, internal audit resources can become stretched. As we continue to deliver against our audit plan, it's highly likely we will be increasingly pulled into any COVID-19 related discussions. Our unique position within the business means we're a great touch point for the Executive to question current processes and controls for various areas of the business. We also have established relationships, meaning we can help facilitate and ensure any required action is implemented. Our unique position in the business can see the lines become blurred for any auditor. Where previously we would not want to necessarily be involved in the decision making, here it may be necessary for us to be a part of the decision making. When situations like this arise, it's important for us to remain objective, risk focused, practical, and valued. Audit shouldn’t be seen as a road block, but rather, a trusted advisor; bringing to the table a way of thinking which is both practical, yet considerate of the risks and our business' risk tolerance levels.
There is a range of articles and resources available online already which can help audit teams assist with COVID-19 related discussions and business continuity. I have included links to all these articles are the bottom of this post.
So whilst we are busy assisting with COVID-19 discussions and business continuity planning, how do we ensure that our own internal audit activity is not impacted? Below is a list of activities or suggestions which audit teams can undertake to ensure they remain resilient.
Ensure we have the technical capability – Simple items such as ensuring team members have the ability to work remotely, VPN access is working, and documents are placed in the cloud (such as OneDrive or Google Drive) are the basics which can sometimes be overlooked. Most organisations already have features such as Teams, OneDrive and / or Google Drive available which can be accessed should VPN services not be available. Ensuring working papers are maintained on the cloud can help ensure audit teams are able to continue to work should any software or audit specific programs drop off line or team members are unable to access the VPN.
Review the annual plan – Particularly where auditors may need to work across locations, review the plan to see what audits can be performed remotely or which ones can be deferred. As Internal Audit becomes drawn into COVID-19 discussions more frequently, it may be worthwhile to defer less critical audits and free up available resources to assist the organisation with its business continuity planning.
Review audit team structures – Where teams are split across location (i.e. entire IT audit teams are geographically located in one area), it may be worthwhile to separate some team members. For instance, splitting teams into two and placing them on separate floors within the office or even separate buildings, you may reduce the risk of losing an entire arm of your audit team should there be an outbreak in your office. Similarly, where an audit currently has a large number of team members, it may be worthwhile to reduce the number of auditors on the team, extend the audit timeframes, and ensure there is enough separation so that an entire team may not be available.
Review our audit approach – Whilst most teams are likely already using Skype or Teams to have remote meetings, this can also been seen as an opportunity for us to try new techniques and approaches. Where possible, audit teams may wish to undertake more in depth and detailed analytics rather than placing reliance on traditional walkthroughs and controls. Encourage a ‘safe to fail’ environment and allow audit teams to try new things or investigate work around where traditional face to face meetings are not available.
Bring in guest auditors – Where audit teams are geographically separated, it may be worthwhile to share resources across teams within your current office. For instance, if your IT audit team is located in another office and cannot travel, consider using IT team members based locally to assist with your audit processes. This is an opportunity for both audit teams and the broader business. For audit teams, it provides an opportunity for auditors to learn new skills, but to also educate others on the audit approach; what we look at and why we look at it. For business areas, it can help them to better understand the role and purpose of audit. It can also help embedded that audit mind-set within teams.
Maintain good and regular communication - As priorities change and resources move, it is important that we keep both management and auditees up to date on that activities of internal audit. Where an audit needs to be deferred or timeframes revised, it is important that we communicate this to relevant stakeholders. Not providing good and regular communication can result in us having to field more questions, taking up already valuable time and resources.
These are only a few suggestions on how to remain resilient as an audit function during these challenging times. Above all, it is important that audit teams remain agile and flexible as it is likely that team members will need to be moved and priorities changed at short notice.
Below are a set of links to other articles and guides which may help you in assisting the business with their continuity plans and maintaining an audit function.
Normal Marks Blog - https://normanmarks.wordpress.com/2020/02/28/how-can-we-help-with-coronavirus/
ICAEW (this is primarily for financial statement auditors, however the concepts can be used for Internal Audit) - https://www.icaew.com/technical/audit-and-assurance/audit/group-audit/coronavirus-guidance