Effects of the COVID-19 Pandemic on the Internal Audit Plan

Author: Efsun Fatemeh Amani

During the pandemic, many companies have partially or entirely stopped their activities to protect their employees’ health. Therefore, internal audit activities are also affected by this situation. For this reason, the internal audit manager should periodically evaluate and review the prepared strategic audit plan regarding suitability, applicability, and usefulness.

In addition, by evaluating the effects of this situation on the control environment and internal audit activities, it should determine, in harmony with senior management and the audit committee, whether specific planned audits will be postponed from a risk perspective and whether different audit areas will be prioritized. As a result of new decisions, new items can be added, or priorities can be changed by making changes to the internal audit plan when necessary.

How is the Internal Audit Plan Affected During the Covid-19 Pandemic?

The internal audit manager re-evaluates the company’s risk map and compares the current audit plan with the new risks that may arise from the unique situation. As a result of the new evaluation, an essential situation in terms of trouble in the previously prepared risk map may have been replaced by unknown risks arising from the epidemic. In this case, changes in the internal audit plan and the priority order in the action plan may vary depending on the company’s field of activity.

New actions that can be prioritized in the internal audit plan during the epidemic period may be as follows:

• Whether the revised Travel Procedure has been complied with,
• Whether the working-from-home procedure is followed or not,
• Tracking the vehicles allocated to the personnel with the tracking system,
• Monitoring compliance with the revised personnel code of conduct to prevent infection,
• Follow-up of revised or discontinued internal and external communication strategies,
• Whether business continuity plans are followed,
• Long-term commitments, payment terms, contracted purchases, rents, etc. Post-revision follow-up on issues,
• Whether the required capacity level in information technology and network infrastructure is provided,
• Examining potential risky situations that arise due to remote information technology access,
• Monitoring the implementation of policies to prevent or reduce overtime,
• Monitoring the timely, complete, and accurate submission of state support requests,

Issues to Consider in the Implementation of the Internal Audit Plan

The chief audit executive should evaluate how the outbreak may affect the organization’s existing corporate governance and internal control framework.

In case of partial or complete closure of office buildings, business operations become virtual and require more conferencing, video calls, and email correspondence. Therefore, it may lead to intentional or unintentional circumvention of controls, failure to comply with separation of duties, or invalidation of approval procedures. Deviations from the standard workflow often reduce the level of internal control, which can lead to opportunism by putting pressure on individuals regarding cost and time.

The internal audit manager, who has detailed information about the institution, business processes, control points, and corporate culture in the institution, must accurately evaluate the risk of fraud and abuse that may occur and accordingly reassign internal audit resources and develop recommendations on this issue.

Some issues that the internal audit manager should address are as follows:

• Are key control processes designed effectively?
• What additional controls should be considered regarding the organization’s exposure to internal and external influences?
• How can employees’ productivity be measured and controlled when they work from home?
• Is there sufficient awareness of possible negative external factors in financially related processes?
• Does a reduction in available employees lead to an increased risk of misappropriation of assets?
• How is the company’s performance?
• Are there additional risks arising from the current situation?
• Reduced production, supply disruptions, disease, etc. Do situations lead to significant deviations from budget estimates?

How to Continue Internal Audit Activities During This Process

According to the internal audit manager’s new evaluations, after clearly determining the priorities for the moving process, he should share the audit plan with the board of directors/audit committee. Then, the new plan should be formally reapproved. 

Considering the safeguards, the chief audit manager should determine how the internal audit plan will be implemented and consider the following options regarding the fieldwork required for each audit:

1. Can fieldwork be carried out effectively or using modern communication tools, such as accessing a local server or secure cloud-based share drives to facilitate video conferencing, sharing computer screens, or exchanging documents?
2. Can the audit manager use local internal or external resources who can go to the company and perform on-site process reviews, document reviews, and control tests while managing the daily follow-up and review of audit work remotely?
3. Can internal audit use the information technology data access structure to evaluate specific risks arising in the audit area?
4. If deemed effective and appropriate, define new procedures to carry out the internal audit activity specific to this period and evaluate any errors that may occur in the controls. For this purpose, can alternative control methods be evaluated using the data obtained?
5. Can it be evaluated whether these units can support special audits by reviewing the activity processes of the institution’s other assurance-providing units, such as compliance, quality management systems, security guards, and risk management?

Conclusion

To ensure that the activities of the audit team and internal audit actions reach correct results, the audit manager must comprehensively examine and evaluate how the epidemic situation will affect the internal audit plan. Internal audit managers must first consider the health and safety of their personnel, then re-evaluate their audit plans in terms of feasibility, applicability, and usefulness, and consider new risks that may arise due to this extraordinary situation. 

Therefore, internal audit managers and the audit team must play an essential role in helping the organization adapt more effectively and efficiently to its extraordinary situation.

Bu gönderi şu adreste de mevcuttur: Türkçe