COVID-19 has already had an incalculable impact on organizations worldwide — and at press time, the expected second wave appears to be gathering steam. The extraordinary upheaval wrought by the virus is making mere survival an uphill battle for many businesses, and in turn their internal audit functions. At the same time, the never-before-encountered challenges are creating some opportunities for practitioners to demonstrate their resilience and their creativity.
In New York City — hit hard and still standing — the New York City Economic Development Corp.'s (EDC's) internal audit department shifted its existing plan and started doing projects for the organization that weren't on the original schedule, notes Jennie Wallace, the organization's chief audit executive (CAE). The EDC formed a committee to assess the need for rent relief, for example, and internal audit was asked to help review the process around accomplishing it. That kind of impromptu help resulted in a changed relationship with leadership, Wallace points out, which welcomed internal audit's assistance — not always the case in the past.
In many organizations, auditors have similarly taken on an array of critical responsibilities in the face of the viral crisis. And their knowledge of what needs to be done to keep the enterprise operational has raised their profile. Indeed, Wallace isn't the only audit executive who notes enhanced relationships with stakeholders, updated response plans, and improved internal audit processes — all accomplished while working from home.
Stakeholder Ties Pay Long-term Dividends
Jeff Hall, director, professional practices, at Principal Financial Group in Des Moines, Iowa, headed internal audit's initial response to COVID-19. Since that time, he says, he's noticed an added luster about the team's image. "During a crisis, there are opportunities to further solidify our role in the organization," he comments. "And our brand improved as a result." Internal audit kept staffers fully engaged, he adds, but opened the door to new relationships with long-term potential.
The company's skill at navigating the crisis enabled the audit department's success by providing two critical elements, Hall stresses: "the right people making the right decisions and good communications from the corporate response team." In particular, he notes, the internal audit team relied on its strong connection with the enterprise's chief risk officer. Facilitated communications, he emphasizes, enabled timely decision-making.
"We started working from home right away, in mid-March," Hall says. The internal audit team immediately took a leadership role, stepping back to quickly assess whether audits in progress could continue or new ones could start. Almost 90% of "in-flight" audits could continue as planned; 20 or so were postponed until later in the year, and about 10 were rescheduled to begin earlier.
Importantly, Hall adds, company directors contacted all business unit leadership teams within the first two weeks after remote working began. They explained why "full-court audit" would have to wait, he says, but that practitioners could help in several areas and wanted to be as available as possible.
"That was well-received," he notes. Ultimately, the department fielded 18 different requests, totaling 1,200 hours of work over a 12-week period.
Internal auditors also worked with risk officers for each business to inventory all the system and process changes — mostly temporary — mandated by regulations in the wake of the pandemic's financial burden; each risk officer maintained a customizable template. Regulations demanded that Principal waive withdrawal fees in some cases, for example, and that it raise loan ceilings for 401(k) participants; the audit team also helped evaluate and validate the impact of those changes on risk status. Internal auditors were tasked with "identifying the highest-risk changes and making sure each change actually occurred and that it stopped at the right time," he adds, noting that regulators and key customers will likely inquire about that, too.
The organization had a road map for responding, though it was admittedly not based on practical knowledge. "We have a response plan that includes a pandemic," he says, noting that all pandemic response plans were developed by people who had never actually experienced one. "There's a look-back occurring," he adds. But he points out, too, that road map or no road map, the whole company managed to morph to 100% work-from-home in just a week.
This Is the New Internal Audit
The COVID-19 pandemic is drawing a line between internal audit then and internal audit now. Many departments have gotten “a wake-up call as to their value in the organization,” explains Robert Berry, former executive director of internal audit at the University of South Alabama and now president at consulting firm That Audit Guy. Those that did not hear from executive management asking them to be a part of the crisis recovery team should be concerned, he says, because “it shows that their value in the organization is not where they really want it to be.”
Berry cites the case of one company’s “let’s wing it” approach to employees working from home. “Essentially, employees were taking computers from the office home,” he says. That should have been an issue raised with management by the internal audit department, he stresses — but no one called internal audit, and audit team members who spoke up about it were ignored. By contrast, another company’s CEO “actually put internal audit on the crisis management team to help deal with the situation,” he says.
Internal audit’s higher future profile will be accompanied by doing things differently, agrees Jennie Wallace, chief audit executive (CAE) at the New York City Economic Development Corp. “This is the new internal audit,” she says, noting that practitioners are collaborative members of the organization and that CAEs are going to emphasize building relationships more than ever. “There’s so much internal audit can do that people hadn’t thought of,” she stresses.
Internal audit will brainstorm at the start more often, Wallace says, and not simply come in after the fact to identify gaps. She explains: “I say to management all the time, ’I want to give you the answers to the test before the test.’”
Berry agrees that “auditors will need to take on tasks that they should have been completing all along.” And they’ll need to get accustomed to working with new colleagues — some of them fellow employees, some not — in new ways on those new tasks, he says. “The pandemic has shown us that you can work with someone in a different location and still be productive.”
The Best-laid Plans
Jade Lee, director of Internal Audit and Enterprise Risk Management at AltaLink in Calgary, Alberta, also had a companywide pandemic response plan available when COVID-19 struck — but it didn't anticipate the severity of the virus' impact, and it didn't cover internal audit processes at all. "As a result," she says, "adaptability and flexibility are key."
As an example, Lee says that although transitioning her team to remote work proved challenging, it quickly became the norm. Then internal audit had to pivot once again upon returning to the office. "However, after being back, it's again interesting how normal it felt immediately," she says.
AltaLink transitioned to a work-from-home environment on March 16, but as an electrical transmission company, key operations must continue. The company restricted access to the office to essential workers, Lee reports, including field personnel working in cell structures. She was temporarily seconded to the integrated Emergency Response Plan (iERP) team as the representative for the entire Finance division. "In that role I had visibility into the iERP team's planning and operations during the height of the lockdown," she says, "and I was responsible for communicating all essential information to the rest of Finance leadership."
During the first two months of working from home, Lee put some internal audit items on hold — such as closing projects or starting new ones — to prioritize business operations and avoid interrupting essential work. "I knew that every department was adjusting to the transition," she notes, "and with operations as an essential service, I did not want internal audit to be an additional burden to existing workloads." The team spent the time working on open audit projects, rationalizing internal controls, and working with control owners on electronic evidence.
Lee adds that she and her team shifted back to more normal audit operations after about two months, resuming their work on the audit plan at that time. Still in a 50% work-from-home/in-office rotation, though, she faces the challenge of managing a half-remote, half-in-person team: Most meetings with the businesses are still held via teleconference due to meeting restrictions, for example. But most of internal control evidence is now electronic, Lee adds, and "many processes are more automated than they used to be." And while the audit plan has fallen behind schedule due to pandemic-related disruptions, Lee receives support from her audit committee, to whom she recently presented an update that defers some projects to 2021.
Calendars Revised, Agility Tested
The EDC's Wallace is also looking at an altered 2021 audit plan. Her team was actively involved in the organization's pandemic response efforts, offering leadership guidance on what they thought executives needed to do — resulting in several new programs and processes developed by management. "When we look again," she adds, "we'll see how they did with it."
The EDC's involvement in the city's response to the pandemic, Wallace explains, was significant. Its efforts included:
- Activating multiple sites across the considerable real estate the EDC manages and maintains to make space for hospital beds and for temporary housing for first responders.
- Creating a partnership of researchers, innovators, and the medical and public health communities to develop a bridge ventilator in less than a month; the device replaces manually operated bag valve masks as patients go on and off traditional ventilators.
- Organizing the efforts of 70 local business partners to manufacture shields and gowns.
- Creating a new supply chain, totally local, for COVID-19 tests.
"We will be looking at some of those things," Wallace says, noting that two of the projects are already on the audit plan. She also reports adopting an Agile-like methodology to identify large streams of departmental work. "Within those larger audits are subprocesses," she explains. "The areas I chose from the annual risk assessment for Agile auditing include some of the COVID projects we did."
The assistance continues, Wallace adds, even as the second wave starts to make noise. "We've finished some of the projects, and some are still going on," she reports. The construction audit team, for example, is working on several ad hoc projects. And that's how Wallace hopes it stays. "Internal audit was not where it needed to be," she explains. "I'm trying to create a best-in-class function, and I'm hoping the things I've built will get better and better, and more finely tuned."
Reprioritization and Resilience
Nora Kelani, assistant manager, Group Internal Audit, at Trust Holdings in Amman, Jordan, has expanded her role during the pandemic, too. A key part of her job had been business trips for meetings with board members, audit teams, and executive management. "The moment traveling was no longer an option," she says, "was the exact moment we had to be resilient enough not only to question how we do things, but to take one step back and re-evaluate what we're doing, what we're focusing on, and how relevant it is to the current crisis."
Job one was stepping out of her traditional audit role and supporting the enterprise's crisis management efforts, Kelani reports. She focused on the organization's immediate needs, she explains — even though that was neither addressed in her internal audit education and training nor detailed in the guidance provided by industry organizations. Indeed, she emphasizes the challenge of wearing numerous hats: supporting the business during the crisis, while also trying to maintain objectivity and independence.
No profession will be the same after the pandemic, including internal auditing, she emphasizes. "We learned that digitization is no longer optional," she says, "that resilience is a must, and that trapping ourselves in the box of 'We're auditors; we can't be part of that' cannot work." And, she adds, "we learned that as long as the right disclosures are made to the right people, an internal auditor can take a part in steering the business ship when needed, instead of helplessly watching it sink to be able to report about it 'objectively' later."
Keeping communications flowing smoothly and efficiently is key to success in this era, Kelani stresses, despite the inability to meet with clients or stakeholders in person and the chaos that comes with any disruption of such magnitude. That's true for everyone who works in a multinational corporation, she adds, and needs to efficiently communicate lots of information to numerous stakeholders at the same time.
Expanded Staffing Options
James Hansen, vice president of the Office of Risk Management (ORM) at Compassion International in Colorado Springs, Colo., says his organization is embracing remote work as a new normal. That includes emphasizing cloud-based peer-to-peer software platforms, he says, "while exploring the right balance of remote and virtual delivery solutions." It enables regional hiring, too, instead of requiring candidates to move to the organization's headquarters city. "Long term," he adds, "this may allow us to innovate by tapping into a wider market of audit professionals we previously would not have logistically been able to entertain."
Indeed, he says the new norm has also leveled the playing field for staff members who were remote long before COVID-19. "Now everyone has that same remote meeting application experience," Hansen explains. "Previously, remote workers were likely on a call with a room full of people, while the in-room participants had the benefit of far fewer tech issues and additional interpersonal verbal and nonverbal communications." Another benefit: It's no longer a challenge to reserve those conference rooms.
Hansen's enterprise works with 8,000 church partners in 25 developing nations — in impoverished areas of the countries, and often in remote locations, requiring many manual processes. It's still "a very limited opportunity," but the organization helps equip partners with technology that can be leveraged for remote auditing. Hansen emphasizes that from a risk standpoint, entities need a robust digital platform for operations. "As we move to a more digital aspect of our business, on both the revenue and program sides," he says, "practitioners will have to have the skills and knowledge to audit that new virtual reality."
Internal audit has continued its engagements, but has narrowed the scope if it would normally involve global functions where locations have shut down. And it has escalated plans to implement virtual and remote audit solutions. Maybe the biggest change, however, is what Hansen calls "a heightened level of cross-functional collaboration and responsiveness and an increased level of understanding of what is a priority and what can be delayed."
Hansen's ORM includes Audit, where operational and technology audit teams are housed, Risk Management, Incident Response, and GRC, he explains. "Our structure is probably unlike any other audit shop, and may not suit traditional audit purists," he says, "but I can tell you that having Risk and Audit working together with Incident Response under one roof has been very beneficial."
Every internal audit department's experience during the pandemic will be unique, and nobody has any idea exactly how much disruption is yet to come. But the early evidence is powerful and positive for audit practitioners, and it bodes well for continued progress toward achieving the trusted advisor status internal auditors seek.