COVID-19 has raised the stakes for health and safety in every organization, producing a plethora of new processes and guidelines to address the risk. The IIA's annual Pulse of Internal Audit survey asked CAEs whether they had reviewed health and safety processes at their organizations in the past year, and the results were surprising.
Only about one quarter had conducted reviews within the past 12 months, according to the responses from 588 CAEs provided in November 2020. In addition, about a third said they had not conducted health and safety reviews nor did they plan to do so in the future. A few said they were planning to do reviews (16%) or relied on reviews from other parties (14%).
These findings may imply there is some question as to whether it is internal audit's role to assess health and safety. "I am surprised that at this point health and safety is not on the radar of chief audit executives (CAEs)," says Stacey Brooks, manager of Workplace Safety System program support and alignment at General Motors. "Maybe larger companies are relying more on the second line of defense within departments to manage worker safety and health to perform internal reviews, but in regard to internal audit functions providing additional organizational value, I think there's a big miss there."
Differences between industries were surprisingly small. Although financial services respondents were more likely to say they did not plan for health and safety reviews (47%), the averages for most of the other industries hovered around one-third. This includes industries with high physical contact, such as healthcare (34%) and educational services (38%). With research showing how easily COVID-19 can spread by physical contact, these figures are worrisome, to say the least.
Indeed, Richard Chambers, former IIA president and CEO, lends credence to the concern that internal audit may not be providing sufficient organizational value in areas where it should in his blog post, "Return-to-workplace Risks: Is Internal Audit Stepping Up?" After analyzing similar findings from an IIA Audit Executive Center poll, Chambers writes: "This signals that a large number of internal audit functions are on the outside looking in on some of the biggest risks facing their organizations. This is unacceptably high, considering risk assessments should have been updated to cope with the pandemic crisis."
The Value Internal Audit Can Bring
Given its unique cross-departmental perspective and direct reporting lines to the board, internal audit has the ability to contribute to the assessment of health and safety practices and protocols not just from an assurance standpoint, but also from a consulting perspective. Katrina Barrett, principal at MAC Management and Compliance Consulting in Atlanta, says, during the pandemic, organizations are recognizing those skills within their audit functions.
"Oftentimes, we like to think of our internal audit expertise as very value-add and consultative in nature," Barrett says. "For team members across many different industries and spectrums of organizations to be tapped in such a critical time period to perform vital functions is further evidence to the broad skills internal auditors bring to the table."
To effectively contribute in the COVID-19 era, the chief audit executive (CAE) should be able to communicate how the organization is providing a healthy and safe workplace in accordance with established guidelines for that jurisdiction, Brooks says. "Guidelines could include mask mandates, social distancing, temperature checks — anything established in that environment for public health guidelines," she explains.
Brooks says CAEs should start with a solid understanding of the published guidelines issued by the Centers for Disease Control (CDC) and the World Health Organization. The American Society of Safety Professionals (ASSP) also provides updated guidance and health and safety-related resources.
Beyond mandatory guidelines, the internal audit activity must understand the public view of what is considered "safe," especially as misalignment with these perceptions could constitute a significant reputation risk for the organization. "Consumer or stakeholder response to health and safety cannot be overstated, and it's easy to overlook if focus is only on minimum requirements," Brooks says.
"If you go into a store and you see that they're not following COVID-19 protocols, even if your jurisdiction recently relaxed requirements, you may decide to exit the store and take your business elsewhere," she explains. "It's not about just following the letter of the law, it's about being a good corporate citizen."
The Rhode Island Manufacturers Association recently recommended one potential model for internal audit involvement in health and safety that includes a COVID-19 designated internal auditor checklist. Some of the internal audit responsibilities outlined on this checklist include assessing whether:
- There is organizationwide knowledge of the COVID-19 Response Plan.
- Masks are worn in required areas, as well as adherence to personal protective equipment guidance.
- The organization complies with the Department of Health, and applicable signage and checklists are posted in visible locations.
- Daily cleaning schedules are documented and monitored.
- Social distance is adhered to in gathering areas such as breakrooms.
- Human resources is monitoring/reporting employees' absences and testing status.
A Greater Emphasis on Health and Safety
Even as COVID-19 vaccinations are underway, there remains within the business community an expectation that the focus on health and safety will not subside. With its responsibility to ensure the organization is proactive in addressing long-term risks, internal audit's role in this area is not expected to lessen, either. In fact, in the long term, it is expected that regulators will place a greater emphasis on maintaining an updated pandemic policy, as well as policies on day-to-day risks, including air quality control and adequate cleaning procedures.
In many regards, businesses should consider health and safety not only from a moral perspective, but also from a financial perspective. "Health considerations in regard to a physical office environment must be looked at as providing a return on investment," says David MacLean, founder and president of McMac Cx, an environmental services firm in Houston. "It reduces costs per employee, minimizes absenteeism, reduces turnover, and provides greater ease of high-quality recruitment."
"People want to come to buildings where they know they will be healthy," MacLean says, "and, guess what? Healthy people are going to be more awake in their chair and help the business be more productive."
With so many new considerations falling under internal audit's purview — including environmental, social, and governance and diversity, equity, and inclusion — health and safety on a macro and micro-level, even post-pandemic, should not get lost in the clutter. It's a tall order, but with appropriate consideration of resources and open lines of communication, internal audit functions should be more than up to the challenge.