It may take years to calculate the full human cost of the coronavirus pandemic, but the pain is visible for all to see today. The U.S. has been hard hit. At the time of writing, there were more than 1.5 million confirmed U.S. cases of COVID-19 and more than 90,000 fatalities. Approximately 23 million people, representing nearly 15% of U.S. workers, had filed for unemployment benefits. Some parts of the country have ground to a standstill — a trend that has followed the progress of the virus around the globe.
Congress has thrown roughly $3 trillion at the problem with help for businesses and hard-hit citizens. Other countries have implemented similar fiscal initiatives. But despite these essential measures, economists are divided on how fast economies will recover — not least because the virus has a habit of bouncing back once lockdown measures are relaxed. Parts of Japan reopened in mid-March, but are into their second period of restrictions. In Europe, Italy paved the way for four million people to return to work in early May: Manufacturers opened first, and now bars and hairdressers are emerging from two months of lockdown. Spain is in the early stages of its four-phase reopening, which regional authorities are implementing at different speeds. Many sectors remain closed across Europe, and the impact of lockdown grows by the day.
"This is much stronger in magnitude than the global financial crisis," International Monetary Fund chief economist Gita Gopinath has said. She told The Wall Street Journal in a video interview in April that economies will not pick up until the third or fourth quarters of 2020, but that will depend on whether countries can successfully emerge from lockdowns and stay that way.
The decisions organizations make now will help determine their survival in the short term. And for those that do survive, those steps will also lay the initial groundwork for recovery. Internal auditors can help organizations navigate the immediate risks, while keeping an eye farther on the horizon. They also can strengthen relationships with stakeholders and reinforce internal audit's value along the way.
Sharp Curve Ahead
The pandemic has already brought with it operating conditions that are potentially dangerous for both businesses and people. For example, as soon as Qatar put in place mitigation measures to protect citizens and residents against the coronavirus, businesses went into value-protection mode, according to Moses Chavi, chief audit executive (CAE) at a privately owned company in the region.
In particular, he says that two key themes have emerged for internal auditors and management — ones that are likely to persist during the forthcoming global recession this year: working capital management and talent management. The successful handling of these areas will play a crucial role in the eventual upturn.
"Any company that has only a suboptimal focus on working capital could see their businesses restricted to sustain fixed costs, including employees' salaries and the rent on operational sites," Chavi says. "And with much needed liquidity during the next three to six months, you will still have to catch up despite the fact the world will be entering an inevitable recession."
Similar to economic stimulus plans seen around the globe, locally Qatar's government has played a huge role to cushion economic activities and stimulate productivity through numerous incentives. Those include providing affordable financing and operational cost waivers, such as rentals, payroll support, and deferred loan repayments.
Chavi says he wonders whether businesses optimize costs without affecting their critical components, such as human resources. Finding creative ways of keeping people — such as constructive sabbaticals or by allowing more flexible working arrangements, whatever fits the ethos of the company — could be more expensive in the short term. At the same time, it could pay longer term dividends.
Since the crisis struck, Chavi and his internal audit team have been working flat out on adaptable working shifts fueled by coffee and adrenaline. His first moves were to start collaborating with the audit committee and asking questions among corporate department heads and the financial and business leaders in critical areas of the company.
"We asked them what plans they had in all of the critical areas we had identified," he says. "Apart from doing a fresh risk assessment and pointing out things that they could not actually see, I'm trying to facilitate a stronger relationship between internal audit and the front-line entities."
Chavi has become very active in committees — he was appointed to his company's crisis communication committee, partly to keep abreast of what was happening, but also to advise on how messages needed to be conveyed throughout the organization and beyond. "Internal audit has aggressively created relationships with other control teams across the entire business to make sure there is a common message going around about our monitoring initiatives," he says.
With social distancing policies in place, internal audit has changed its working routines. The team has used video to meet with managers and to carry out checks in such areas as sanitary controls, and employee and visitor screening, for instance. Chavi also has advocated for managers to make tough and timely decisions on, for example, which parts of their portfolios can be restructured, which need to be boosted, and where new lines need to be introduced to diversify and meet changing consumer behavior.
"Executives need to make sure they are aggressive in taking decisions," he says. "That also applies to business continuity plans, which may be irrelevant or outdated in the current situation and need radical overhauling." Chavi says he believes it is crucial to be "brutal with the truth" at audit committee meetings and at relevant executive management meetings.
But there have been some encouraging developments too. The organization's digital transformation has been enhanced by COVID-19, with some companies in the group moving rapidly into social media marketing, e-commerce, home deliveries, and adopting hand-held mobile and online payment. It is a move that he says has boosted customer experience. "Internal audit has had a keen interest in these processes, and we are making sure that we deal with the risks as they come along."
Chavi says that because his internal audit team has been able to hold management's hand through the crisis so far, and has refrained from judging in favor of providing practical solutions or constructive challenge, it will be well-positioned to continue helping in both an assurance and advisory capacity in crucial areas such as working capital management, talent retention, stakeholder relationships, cybersecurity, and data integrity.
"Internal audit needs to be visible and participate. You can't influence anybody without actually befriending them, without being close, without understanding and sharing their pain and troubles," Chavi says. "Applying your emotional intelligence is key to being able to influence the agenda and trajectory of risk management going forward so the business can survive and prosper in the future."
Further Down the Road
The medium-term effects of the pandemic are going to introduce new uncertainties that could make recovery difficult, according to Alexander Larsen, president of Baldwin Global Risk Services, a risk consultancy with offices in the U.K. and North America. Businesses will need to assess and deal with altered social habits, customer expectations, new ways of working, and, in some sectors, unanticipated policy and regulatory changes, if they are to navigate these times successfully.
"Immediately after COVID-19, people are going to be thinking about the crisis and what they need to do to prepare for another pandemic — or whether they are prepared in the event that they lose their job due to the recession that will follow," he says. "They may be wondering why their homes are full of things that were absolutely useless in times of crisis, and that could affect their spending habits over the next couple of years."
Fear could also play a part in consumer behavior, Larsen says. Recent surveys suggest that when countries open up for business again, for instance, a large proportion of people will be scared of visiting crowded places. Three out of four people say they would now not attend trade shows or conferences in the future, according to a recent IBM survey. Some businesses may need to transform their operations into social-distancing friendly models where possible, Larsen adds.
In addition, many employees have learned that they can work from home effectively; some may prefer to continue doing so. Businesses that have been reluctant to be flexible may be forced into changing their policies to retain talent. Moreover, companies should not expect the business landscape to remain static as governments across the globe could take different views on tightening or slackening regulation from supply chains to financial contingencies. Political risk is also likely to increase.
"When I worked in Iraq during the construction of the world's largest undeveloped oil fields, the government often and unexpectedly instructed our company to stop buying products from certain countries, despite the strategic and financial significance of the project," Larsen says. "These were political decisions, often with valid reasons, and in the aftermath of COVID-19 it will be a more political world where such government sanctions could become more frequent."
Larsen says good risk management will be critical for survival and that internal audit has a key role to play in making that happen. Organizations will need a thorough understanding of their corporate and departmental risks, with a key focus on critical objectives, he says. They'll also need to examine where survival-level risks, or market-changing opportunities, are identified and linked to key risk indicators — essentially an early warning system for when things start to go wrong or relevant opportunities arise. Scenario planning, risk workshops, and horizon scanning exercises that focus on strategic risks and organizational strategies over the next three to five years must be in place.
"Most organizations that are in a position of worrying about survival should forget about trying to set a risk appetite," Larsen adds. "They are having to take those risks anyway. The question is rather what levels of risk we can tolerate before the viability of the organization is threatened."
Key risk indicators should be introduced and linked to these risk tolerance levels — rather than appetite, Larsen says. That way, the business is put on alert when things start getting rocky.
But internal audit's support of risk management efforts is key. CAEs should use their influence at the board level to ensure the risk function is not tied down by processes and bureaucracy — risk management has to be dynamic. Internal audit also should provide assurance on whether management is implementing risk management's program. "Essentially, internal audit should be the risk function's ally by including risk management as part of their audits," Larsen says. "That will enable it to ensure that threats and opportunities are being identified across the organization and to ensure that they are being properly measured and controlled according to the risk procedures set by the risk management function."
Louis Cooper, chief executive of the Non-Executive Directors' Association, a board training and education, advisory, and support body based in London, agrees with Larsen that some businesses need to reappraise their approach to risk management. He has seen organizations begin to add a velocity factor to their risk matrices that traditionally only measure the impact and likelihood of risk: a dimension that he says needs to be incorporated into scenario planning, as it provides a speed of change component to the assessment of individual risks.
In addition, others are moving away from the traditional enterprise risk management view and toward looking at risk in the extended enterprise. This approach takes further into account that many organizations increasingly rely on strategic partners, outsourced arrangements, and other third parties to take their products and services to market. Cooper agrees that internal audit should be undertaking more informed reviews of management activities and processes rather than doing test checks on individual business processes and transactions — following The IIA's long-held perspectives on risk-based auditing.
Cooper is concerned that an extended lockdown, or repeated ones, could mean that the accuracy of reporting and the information the board receives is compromised. Giving assurance in those areas could be equally affected. Without sending people out on location, internal auditors could be prevented from doing essential checks. In the U.K., the Financial Reporting Council's COVID-19 Bulletin March 2020 offers guidance to external auditors on such issues, which could be equally applicable to some internal audit assignments.
A Test of Governance
Cooper also says that boards have been questioning whether their governance frameworks have been able to cope with fast-changing circumstances and whether they will enable their companies to be agile enough in the coming months and years. Some organizations, for example, have done a poor job of targeting their corporate communications and key business relationships — a clear indication that stakeholder groups and contacts are inadequately mapped and understood. And some have fallen short in demonstrating whether executive leadership has had the right mandate to deal with unfolding problems. Other organizations have been unable to flex their business models — the way some fashion design enterprises were able to switch quickly from making clothes to making protective garments for health workers, for instance — and some have had difficulty with adapting to the culture shock of continuous remote working.
"I'm not sure that governance frameworks have been tested in this way before, including in fundamental areas such as business continuity planning," Cooper says. "People are very good at documenting things and putting them in the drawer without going through scenarios and checking that, if something were to happen, what the chain of command is and how it works in practice."
If internal audit has not been involved in those areas historically, boards will need them to take that role now, he says. They also will be looking for the function to assess how well the business has performed, identify gaps, and collate and disseminate the lessons learned to the board and management.
As well as participating on management committees dealing with business recovery, internal auditors need to work in a smarter, more focused way, says Esi Akinosho, EY Global Advisory Internal Audit leader. That includes following their businesses' lead in forcing rapid digital transformation.
"Internal audit has an opportunity to provide real-time risk advice as businesses establish new processes in the 'new normal,'" she says. "Teams can use predictive analytics to help identify emerging vulnerabilities and opportunities — this will give more timely value-add to management than traditional audit procedures."
She advises audit departments to focus on business-critical risks, especially cost recovery — such as working capital, cash management, vendor spending, and capital expenditure. Internal audit analytics can be applied to identify any cash recovery opportunities. That initiative also should extend to optimizing cost efficiency in the audit department itself.
"Internal audit should make its own contribution to the organization's cost diligence by optimizing the function's costs," she says. "Teams should take advantage of the technology momentum created by remote working to gain efficiencies across the internal audit life cycle. For example, digitize any procedures where possible and consider remote possibilities before spending on travel."
Where the internal audit function is less developed, or has issues with how its brand is perceived, it is time to act. "Organizations must start looking for opportunities to build the function's brand," she says. "For example, redeploy some resources to directly support business crisis management teams — this has the added benefit of building relationships and business knowledge simultaneously."
Similarly, CAEs could build a more flexible resource structure in which, for instance, specialists are brought into the function for limited periods to provide additional expertise — either from within the business or from third-party providers.
"Internal audit has a great opportunity to help organizations transition out of the downturn by using the current disruption to accelerate transformation," Akinosho says. "Internal audit, as a profession, needs digitalization, a flexible people model, new skills, and a more dynamic approach that is more efficient and geared to giving timely insights on strategic risks."
Many businesses are going to have a life and death struggle with the effects of the coronavirus outbreak. Some will not make it. Those that do have their work cut out in streamlining portfolios and business processes; strengthening governance, risk management, and internal audit functions; and fast-tracking moves to make their enterprises digital — as well as keeping abreast of events and trends in the economy and among customers. Internal auditors have a key role to play in helping ensure their organizations make it along the road to recovery. If there was ever a time to demonstrate the true value of internal audit, it is today.