"Not everyone will be super comfortable with in-person interviews because of COVID-19, but I understand we are business as usual."
That's the response I got when I asked a warehouse manager if he preferred for me to conduct audit interviews in person or over Microsoft Teams. When my organization pivoted to working remotely in April, I was confident we were facing the greatest challenge our audit function would see in 2020. However, our return to the workplace and the new challenges it created proved me wrong.
I've read some outstanding articles and attended great webinars on best practices for auditing remotely, and I'm grateful these resources exist. But I fear many of us are failing to prepare adequately for how to audit when our companies shift back into a state of "normal" — or a new normal unlike anything we've experienced before.
My organization was one of the first to bring all of its corporate employees back to the workplace. With some precautions such as mask wearing in common areas and socially distanced seating in conference rooms, we were told it was "business as usual." However, I quickly learned that business as usual was anything but usual.
Some of my audit clients prefer in-person meetings. Others have asked me to conduct an entire audit virtually with file sharing and video calls from our individual offices in the same building. Still others have preferred a hybrid approach. While I'm still learning how best to navigate auditing during the pandemic, I've picked up a few tips along the way that I hope will help guide others as they also return to the workplace.
Communication is key in the best of times. In the worst of times — or a global pandemic — it's absolutely critical. I've started keeping a catalog of the department heads who prefer in-person meetings versus virtual meetings. If I'm not sure, I schedule the initial planning meeting as a video call, which sometimes results in their telling me to just come to their office. We then discuss their preferences as well as the goals for the audit and work together to find a way to accommodate both.
Sometimes it's a challenge. In the audit referenced above, we needed to observe some processes occurring in the warehouse, but some of the warehouse staff weren't comfortable with an in-person visit from internal audit. At the same time, they lacked the technology needed for us to perform a virtual observation. As I worked with the warehouse manager to find a solution that was both within his team's comfort level and conducive to providing the audit assurance we required, we found creative solutions. For example, he arranged for me to observe an employee who'd already contracted and recovered from COVID-19 and was less concerned about in-person interaction. We also established clear expectations — during my visit, for example, we would all wear masks and distance as much as possible. What had seemed like an auditing nightmare 30 minutes earlier quickly became feasible because of clear, intentional communication and expectation-setting.
In another audit, client team members expressed their preference for conducting all interviews virtually. We agreed to their request and arranged for video conferencing. One of the interviewees, a technical expert with the group, mentioned his exhaustion after our lengthy, 90-minute discussion. With an in-person interview, I would have quickly noticed the warning signs of exhaustion and asked if he wanted to end the meeting for the day and resume later. Since he was sharing his screen, I wasn't able to look for visual cues of discomfort. I learned the importance of more frequent check-ins during video calls and of giving clients more options up front for meeting lengths and structure.
People Not Politics
One of the least foreseen challenges of COVID-19 era auditing has been avoiding what I call "pandemic politics." I work in a building with around 700 people, and each has his or her own perspective on how our COVID-19 response should have gone and how we should be acting in the workplace. Whether masks really work or are an invasion of personal liberty, the extent to which one should limit in-person social interactions, and whether COVID-19 is a devastating virus or "just the flu" are all topics about which most people seem to hold strong opinions. Of course, the mix of opinions held may also differ by region and culture.
I've found it helpful to avoid discussing the politics of the situation and instead focus on the people. I try to assess and defer to others' preferences and comfort levels whenever possible — as long as it does not conflict with the organization's COVID-19 policies — so that I'm not unintentionally sending the wrong message and damaging a working relationship.
Auditors should feel empowered to communicate their preferences as well, and it can be done without getting political. There have been times, for example, when I've found myself uncomfortable with a proposed scenario that did not involve social distancing. Explaining that, as an auditor, it's important to follow the organization's social distancing policies has gone a long way in avoiding potentially dangerous situations without hurting feelings. I've also found that as I show my respect for others' preferences, they are quick to return the favor.
Establish Risk Appetite
In every aspect of the business, internal auditors need to understand the risk appetite the board and management have chosen to adopt. Understanding the pandemic risk appetite is no exception. As an essential business that operates more than 850 convenience stores, my organization has taken on some risk to keep its stores open. Understanding this appetite helps me as I plan, perform, and report on audit and consulting reviews, including a lookback our chief audit executive (CAE) and I facilitated on our organization's COVID-19 response efforts.
However, it's also vital for me to set and define my own personal risk appetite and to verify that it generally aligns with that of my organization. Performing audits at my organization would be especially challenging if I were not willing to accept the risks of returning to our office, resuming some modified business travel, and interacting face-to-face (or mask-to-mask) with clients. Understanding my tolerance for COVID-19 risk has also enabled me to request accommodations at times — for example, asking to be booked on airlines that have strict cleaning procedures and require masks. It's also empowered me to make personal choices such as taking the stairs versus a crowded elevator, wearing a mask during meetings, or distancing myself during larger work gatherings.
If you are an audit leader, it's important to understand your staff's risk appetites as well. Several months ago, a coworker returned from an out-of-town audit where he was scheduled to observe a key second line function. The person he was supposed to observe had been running a fever but insisted he would be there for the audit meeting. Thankfully, my coworker knew his own risk appetite and had been empowered by our CAE to make the right choice by rescheduling the observation. This turned out to be particularly fortuitous as the person he would have been observing received a positive COVID-19 test result later that day.
We had our "normal" audit process pre-COVID-19. Then we developed a new normal during our pivot-to-home time and again when we returned to the office. But frankly, my new normal changes with every new engagement I begin. It changes with every meeting I conduct and every project I lead. Change is our new normal. I used to believe that communication was the most essential skill for a 21st century auditor. I now believe it to be agility. Only through proactively anticipating and adapting to a constant state of change will we succeed in staying relevant and delivering value both during and after the pandemic.
Agility involves looking at each engagement with a fresh eye. Reusing the previous year's work program is widely regarded as a dangerous audit pitfall, yet many auditors still blindly follow this practice. During the planning phase of every audit, our group tries to approach the scope with an open mind and adapt our procedures to add the most value. Sometimes this involves adding a consulting component. Sometimes it involves scoping out a low-risk area or focusing more on an emerging risk. I have yet to work on an audit where the risk control matrix was identical from year to year. While agility has historically been a core element of our internal audit department, the pandemic and its new challenges have only emphasized its importance.
While the pandemic brought unprecedented challenges, auditors responded with insight and innovation. In many organizations, auditors took on new roles as trusted advisors, using their knowledge of risk to provide advice and assurance in nontraditional ways. Some auditors assisted with evaluating or advising on the COVID-19 response plan. Others developed more efficient procedures using data analytics or robotic process automation. Auditors found that not only could they audit remotely, but they could also minimize disruption to the business. We found that, in some cases, auditing virtually actually provided benefits.
It could be temping when returning to the workplace to go back to "business as usual," especially if at that point the threat of COVID-19 is greatly reduced. Or it could be tempting to retain all the changes made during the pandemic. But we must evaluate which changes were true innovations that we should keep versus adaptations needed for a period of time. We must also keep innovating at the same speed we did in 2020 because emerging risks aren't slowing down.
Auditors proved in 2020 that we were capable of rapid, creative, and noteworthy innovations. It's only by continuing along that revolutionary path that we can continue to increase the value audit provides into 2021 and beyond.