In many ways, coronavirus (COVID-19) is the corporate governance crisis we've been preparing for all our lives. It is a public health crisis that has caused an economic crisis, which for many organizations has also caused operational or liquidity crises.
Its consequences dwarf the financial crisis of 2008 and the Sept. 11 attacks combined. It is global in scope and unending in duration. And yet, corporate boards, management, and internal audit teams have to confront this menace somehow.
We can start with the obvious: Board directors are as bewildered as everyone else by COVID-19. Clearly the pandemic challenges organizations in all sorts of ways, and directors do grasp that point — but understanding the exact ways COVID-19 will challenge their businesses is no small thing.
"For many, this particular risk — basically, of businesses completely shutting down and everyone staying home — well, that wasn't on the risk profile," says Shellye Archambeau, who serves on four corporate boards, including Verizon and Nordstrom.
That puts corporate directors in a delicate position. From management, they want to hear about new information, new risks, or new plans being executed, and that can be a lot; Archambeau figures she has been on board-related calls at least once a day, if not more. At the same time, however, directors don't want to burden management too much, since the executive team has plenty to do already.
"It's very important at this unusual time to trust management, and let them do their job of running the company," says Alpa Parikh, who was chief audit executive at Puget Sound Energy until last fall and now serves on the audit committee of a Seattle-area social services non-profit. Her operating principle these days: Don't ask unnecessary questions of management; do think about the long-term implications of short-term actions the organization takes to keep operations alive right now.
That makes sense. Ill-advised actions today could constrain a company's strategic choices tomorrow, next month, or next year — and that's what a board is supposed to prevent. In that case, several issues rise to the top of corporate directors' concerns.
Keeping Things Going
Foremost are questions about the organization's cash position, and its ability to continue as a going concern even if COVID-19 drags on for many months. (And let's not kid ourselves, it probably will.) So, for example, one specific priority would be an organization's ability to preserve the cash it has. That means directors will want to know about spending and hiring freezes, and also about approval processes for significant expenditures — including whether those processes are sufficiently tight, given the company's projected cash flows.
Then again, Wendy Pfeiffer, on the audit committees of cybersecurity firm Qualys and consulting business SADA, says companies can't forget about "market moments" either, such as the chance to pick up a merger target on the cheap or to launch a new line of business.
You can't do those things without cash, so cash preservation is important; but directors also want to know that management is trying to maintain strategic perspective and flexibility, too, so the company can jump on a good moment when one arises.
OK, that concept is easy enough to grasp. Here in the real world, however, audit committees are trying to understand such issues while the economic ground keeps shifting. Well-understood key performance indicators or key risk indicators might no longer fit. Models of expected customer behavior, sales cycles, liquidity, or supply chain risks could all unravel.
Directors are acutely aware of that possibility, and want assurance that management — and audit teams — are trying to stay ahead of such shifts. That means lots of scenario-planning. "Leverage your analytical skills to figure out what the scenarios might look like and capitalize on strategic agility," Parikh says.
And audit committees still have their day jobs overseeing the financial reporting function. Regulators have published a laundry list of accounting items that could be difficult to calculate these days, and those items are sure to be concerns for the audit committee, too.
Among the issues flagged: lease modifications if a company starts giving back space (which could actually goose the organization's income statement upward), impairment of goodwill or intangible assets (which could wallop the income statement and the balance sheet), revenue recognition, hedging, and more. COVID-19's effect on those items will involve a lot of subjective judgment. Audit committees will want to know that said judgment is sound and grounded in good data, as much as possible.
Internal Audit's Role in Continuity Today
As companies are scrambling to understand what their new risks are, and how to amend business processes to keep those risks at acceptable levels, internal audit has an important role to play. It is internal audit's job, after all, to perform critical assessments of emerging risks, use data analytics to build monitoring tools, and counsel management on possible changes to business processes. Those are crucial corporate capabilities as COVID-19 continues.
"We already have those skill sets that allow us to adapt quickly to things like this," Parikh says. "That overview is very important right now, when you can look at processes end to end, across different functions and areas within a company to assess risks and identify potential opportunities."
That's the nub of the COVID-19 challenge for organizations, really. Success isn't about having a business continuity plan per se, because those plans never match the disaster you actually face. They only bring the shortcomings in your plan into sharp relief. The ability to plan, even under today's enormously difficult circumstances, is what keeps an organization alive.
It's also what audit committees want to see from management teams: an ability to observe changing conditions and devise a response that won't trap the organization in a strategic or operational dead end.
"I'd rather have the human brain," Pfeiffer says. "I'd rather have people who are aware and engaged and have their own early-warning system and expertise and creativity." Then let those people collaborate their way to a feasible solution, "rather than work their way through a playbook."
Those are words for an audit team to live by. And if the first weeks of COVID-19 are any indicator, we'll be living by them for quite some time.