The COVID-19 pandemic has drastically impacted businesses and their known risk profiles. As part of an organization’s third line of defense (after the business’s operational management and its risk management and compliance functions), the internal audit (IA) function inherently possesses a broad and deep understanding of business processes from beginning to end, as well as a highly relevant skill set, uniquely positioning it to be a valuable contributor to the crisis response today and into the future.
The COVID-19 crisis presents an opportunity for IA to fortify its partnership with the first- and second-line teams, as well as with external auditors, by:
- Working with the other teams to identify and articulate emerging risks
- Participating in crisis committees
- Assisting in operational stress-tests
- Reimagining the role of the IA team
As new processes are developed and implemented, new and emerging risks will be identified; IA will need to be dexterous and flexible as it considers reprioritization, innovation, and reinvention.
IA Contributions to the Crisis Response
1. Working with internal teams to identify and articulate emerging risks
The rapidly changing environment brought on by COVID-19 has undoubtedly impacted risk in every area of the business, as well as affecting IA’s role in assessing risk, testing controls for design and implementation, and giving recommendations relating to control gaps and risk mitigation. As rapidly as the environment changes, IA will need to keep pace.
This will require that IA expands how it sees itself and the value of its services. In the role of subject-matter experts in the field of risk identification, management, and mitigation, IA can clearly evaluate and articulate emerging risks that will arise from the implementation of new operating models and business practices.
2. Participating in crisis committees
Becoming involved in an organization’s crisis committee is one of the best ways the IA function can contribute. IA’s presence on crisis response teams allows IA to learn about new control gaps, elevated risk, and process disruptions and breakdowns as they are occurring, giving IA the ability to make real-time, value-added risk mitigation recommendations. Further, IA’s organizational reporting relationship as an independent function makes it a great liaison between management and the board and the audit committee. In its capacity as an independent function with direct reporting lines to the board, IA can provide a much-needed buffer between management as it is focused on carrying out business in the midst of a universal crisis and the board as it remains mindful of not impeding progress by inundating management with information requests. As a buffer, IA can help management remain accountable to the board by providing an objective, risk-based perspective on management’s plans while keeping the board abreast of rapidly changing events. Consequently, the board will appreciate the ability to guide and support response plans in a timely manner. Staying involved will allow IA to help the organization move beyond surviving in the short term to thriving in the long term.
3. Assisting in operational stress tests
Another way IA can maximize its expertise is by participating in operational stress-tests of both current and strategic processes. As processes are being updated and revamped in this new, high-pressure environment, special consideration should be given to the heightened risk for fraud and noncompliance with regulatory mandates. The partnership with management and areas that oversee risk management and compliance will benefit from IA functioning in its capacity of an independent advisor as opposed to the more traditional assurance services. The transition to providing more advisory services will likely require the reprioritization of the annual audit plan and participation in crisis committees as well as liaising with the board. Such direct involvement in operational stress tests will provide insight into new focus areas and the ability to quickly redirect resources to the most critical issues.
4. Reimagining the role of the IA function
Reimagining the IA function will naturally encourage a re-examination and reimagining of how IA performs its different roles. One way to explore new possibilities in this regard is by partnering with external consulting firms. Such partnerships will enhance exposure to data analytics and the use of innovative technologies to proactively identify outliers and detect fraud and patterns of abuse or corruption. Consultants have the benefit of seeing control failures arise from a variety of different crisis factors, requiring very different remediation and augmentation, and can enhance the IA function by bringing that varied perspective and knowledge to bear. Leverage this moment in time to upskill IA practitioners and to adopt and embed new ways of working by embracing technology such as robotic process automation and artificial intelligence.
Creating a partnership with the right consultants will help IA seamlessly integrate innovation into current processes, allowing for mechanized, ongoing observation and monitoring, freeing up practitioners to address increased risks that may appear as a subtle undermining of the control structure such as inaccuracies in recordkeeping, a departure from conservatism in accounting, or management overrides. IA can access and transform data to present an integrated story of risk, change, and process efficiencies to management.
Emerging as a valuable partner during a period of crisis, IA can use this unique opportunity to redefine traditional and outdated views of the IA function. IA’s distinctive position in the business also means it can be true trailblazer while managing a major disruption, serving to highlight the importance of its obligation to remain independent. IA’s enhanced relationship with management may come with pressures to “own” risk, participate in decision making, or implement processes. This can be avoided by clearly communicating expectations and responsibilities to management as well as confirming alignment with the board and audit committee. This is a critical time for business, and it is equally critical that IA step into its leadership role to provide pragmatic, risk-based guidance that will positively transform business operations today and beyond.