Throughout the weeks and months of the global COVID pandemic lock-down I was privileged to be asked to contribute, speak or lead discussions with Heads of Internal Audit by eight separate leading firms. I heard from hundreds of individuals seeking to discuss, with their peers, the impact that the crisis had on the services they provide. We do not choose a career in internal audit unless we have deep commitment to our organisations and to acting responsibly. So, we were all focused on doing the right thing, balancing competing demands and making the right choices.
When crisis hits an organisation, or a sector, it is more critical than ever for internal audit to demonstrate a willingness to play our part in meeting strategic priorities. However, the question of proportionality is critical, as is the broader picture of risk and assurance across the organisation. With resources under pressure and a genuine desire to protect the organisation without creating unhelpful distractions for the front line, this is my learning:
- Boards need assurance in a crisis more than ever. Central to this is the assurance they get from front line management, but an objective view on the interfaces and consequences of decisions made by managers remains invaluable.
- With a rapidly changing risk profile, the first priority is to re-perform the risk assessment that sits at the heart of the audit plan and to discuss this directly with the Audit Committee. Internal audit should be identifying and advising the Board on where new risks are emerging and the profile is changing. Fraud risks in particular will be evolving given the change in working patterns.
- Blanket decisions to reduce all assurance activity are unlikely to be appropriate. The system of risk management and control will be impacted in different ways according to the nature of the risks. Audit directors should be advising the Board and management on where the most critical risks lie and where assurance is most valuable.
- Internal audit should focus its activity on the controls that are most critical to protecting the organisation and ensuring there are not further shocks. This will include areas such as fraud risk, financial processing and reporting, the supply chain, customer outcomes and security, including cyber and data protection. In less critical areas it is likely to be acceptable and desirable to reduce the workload and the distraction on the organisation. Where possible critical controls assurance should be as real time as possible.
- Regulators will continue to expect compliance and reporting, although they may allow some discretion over the timing.
- Certain audit procedures may not be possible or effective. However, the opportunity to pursue or accelerate data driven approaches and to utilise capability to create future value is significant.
- The assessment of viability will be critical with a need to be clear on principal risks and the assumptions, qualifications and uncertainties underpinning the statement. Internal Audit should be preparing to provide a perspective on this.
- More routine aspects of audit, such as pursuing open actions, need to be carefully and pragmatically considered with a view to which actions remain critical.
In a crisis, the dialogue between the Head of Internal Audit and the Chair of the Audit Committee becomes more critical than ever. Changes to audit plans must be discussed and agreed, with the associated risks clearly articulated. Audit directors need to be clear on how they are continuing to apply the International Professional Practices Framework and should be reporting clearly on independence concerns that arise as a result of internal audit supporting activities that may go beyond its usual remit.
Finally, even in a crisis, Boards require a view on how the organisation will return to a “new normal”. Audit directors also need to reflect and learn from the experiences. I believe, and my view has been re-enforced by my peers across many sectors, that internal audit can emerge from a crisis with renewed purpose and clarity. We can be trusted advisors on the responses to risks, but it takes courage, agility and commercial pragmatism.
