As the vaccine roll-outs raise hope that COVID-19 will subside, auditors may question how the pandemic has impacted financial statements. There are many views regarding how the crisis has changed the world and whether these changes are permanent.
The risk environment definitely has changed. Specifically, there may be greater risk of material misstatements in financial statements, according to our study, "COVID-19 and the Accounting Profession," published in May in the Journal of Accounting, Ethics, and Public Policy. Internal auditors should consider how to incorporate the impact of changes driven by the pandemic on accounting processes into their risk assessment and planning for audit programs and work.
The study surveyed 139 accountants in the U.S. to gain broader insights into their work during the pandemic. Respondents who perform external audits disagree with the notion that the crisis will lead to an increase in earnings management or attempted fraud. Although this finding may reflect respondents' beliefs that stakeholders will be more forgiving of reduced earnings, management may have greater incentive to manipulate earnings during the pandemic. Regardless, the finding suggests that external auditors may be less likely to change their audit procedures to identify and assess changes to risks of material misstatements brought on by the pandemic. Internal auditors should consider the impact of a higher risk of material misstatement in their audit work.
Ironically, survey respondents also agree the crisis will reduce the effectiveness of internal controls and make it more difficult to audit them. Taken together, these findings suggest that financial statements prepared and audited during the pandemic are susceptible to higher risks of material misstatements. Additionally, while some impacts of the crisis on the internal control environment may be permanent — such as remote work — organizations may need to modify existing internal controls and internal audit techniques to accommodate the post-pandemic paradigm.
The Impact on Control
When internal controls designed to prevent and detect financial statement errors and fraud fall short, detection mechanisms such as reconciliations of accounts and internal audits serve to catch those errors and fraud. External audits add a layer of protection to prevent material misstatements.
However, both the prevention and detection features of internal controls are susceptible to weakening due to systemic organizational changes in response to the pandemic. Organizations and their auditors were not prepared for the dramatic and immediate implications and ramifications of living and working through a global health crisis.
Unforeseen economic hardships and physical limitations forced organizations to reallocate resources. People and other resources that had been directed toward internal controls were reallocated to other business functions deemed more critical for survival. As an anonymous auditor commented, "Clients were 'distracted' by the pandemic and therefore providing us with information became low priority." In short, internal control environments were impaired.
Employees' execution of internal control activities also was affected by work-at-home limitations and distractions, coupled with the stress caused by the pandemic. The study finds that the pandemic has impaired the quality of external auditors' work. One auditor explains the downsides of working from home: "It is taking longer to produce work, especially administratively. The office equipment at home, such as printers and scanners, is not as fast as the office equipment at the job office. … People have families and kids who can be a distraction and do not necessarily allow for everyone to be available at the moment you need them."
Specific preventive activities embedded in internal controls also have been impacted. Because of limited workplace access, the ability to separate certain duties has been reduced. Physical access to workplace areas and resources may be restricted to fewer individuals to decrease COVID-19 spread. Physical restrictions to inventory and other assets may be lifted out of necessity, as only a few, select individuals report to work in person. Without the watchful eyes of fellow employees, the ability of internal controls to prevent error and fraud may fall short on other fronts, as well.
Regarding internal controls aimed at error and fraud detection, employees without sufficient home office equipment may be unable to reconcile accounts remotely. Without co-workers in the same room during internal audits to brainstorm or answer questions, a full evaluation and assessment of the effectiveness of internal controls may be limited.
Unable to conduct physical walk-throughs of accounting departments and manufacturing plants, noncompliance issues that would have been detected in person may go undetected. Another survey participant says the pandemic caused "difficulty being efficient as an audit team when not working on the client premises and face-to-face. Internal control walk-throughs (inquiry, observation, inspection) are more difficult when done remotely, as are fraud discussions (harder to coordinate and to physically inspect and observe)."
Other Audit Risks
While respondents agree that the pandemic has made it harder to determine the effectiveness of clients' internal controls, the study also finds that assessments of going concern questions could be more difficult. However, the study did not find that the pandemic increases risk in all areas of financial audits.
For example, respondents neither agree nor disagree that the pandemic:
- Will make it more difficult for auditors to determine whether clients' accounting numbers reflect the economic reality of underlying events and transactions.
- Will lead clients to engage in greater earnings management in their financial reporting.
- Will increase the risk that auditors will not be able to detect material misstatements due to fraud in the financial statements and footnote disclosures.
- Will make it more difficult for auditors to determine whether management has disclosed every important item to investors and creditors in the financial statements so users can make informed, strategic decisions.
Because the study did not find that the pandemic increases risk in these areas, internal auditors need not change their risk assessments with regard to valuations, earnings management, fraud, or full disclosure.
Immediate and Future Implications
Financial statements prepared and audited during the pandemic will undoubtedly reflect business results differently than preceding financial statements. It will be difficult to disentangle the financial implications caused by crisis-related economic hardships from errors or fraud attributable to weakened internal controls. Economic indicators determined using financial statements prepared and audited during the pandemic should be addressed with caution.
Although it is uncertain when organizations will revert to previous activities, there could be permanent shifts in work habits on the other side of the pandemic. With the crisis shining a spotlight on the susceptibility of internal controls to work disruptions, internal auditors must learn how to provide assurance over financial reporting and other internal controls in a post-pandemic world. As organizations re-examine their long-term strategic plans, they must revisit internal controls and devote time, money, and reorganization to these critical safeguards.