By Joseph Reeves | Photo Unsplash
COVID-19 has and will continue to shape our collective business landscape not only with respect to business objectives, goals and operational control activities but also how we effectively manage risk and the role of Internal Audit in doing so.
At Francis King, we have seen social media activity whereby auditors, across all levels and industries, are looking for more appropriate and considered risk management practices now and into the future. We at Francis King, felt it good to collect and consolidate Internal Audit industry leaders thoughts and opinions on the impact of COVID-19 and share these with the wider Internal Audit community.
Over the past few weeks, we at Francis King have been engaging with senior Internal Audit professionals across a range of industries to understand how Internal Audit department risk agendas have changed in response to COVID-19.
Internal Audit teams
The most significant theme from our analysis is the requirement for Internal Audit leaders to show empathy to a business in crisis mode. As such, focussing on risk management, without introducing new policies for non-business critical activities, through re-focussed audit plans has resulted in many cases.
- Ensuring junior team members feel supported and connected through regular catch ups and maintaining a ‘virtual open door policy’ is vital.
- With on-premise audit controls testing not currently possible, business and stakeholder engagement has become compromised in a time when arguably all business risks have increased. As such, for more business critical requirements, video meetings serve a good purpose, but does not replace the ‘relationship building’ nature of face-to-face meetings.
- One clear and consistent message from our analysis is Internal Audit leaders missing the personal team connection. They miss being in the action of the team where they can read the team more effectively to pick up on issues and help maintain and drive required standards. The only way people are working around this is to have more video and phone calls, but this becomes very time consuming.
Inherent and Residual Risks
Regardless of industry, first line operational processes have rapidly changed which is testing Internal Audit teams ‘fit for purpose’ control framework. Issues that may arise is a drop in Quality Assurance efforts. Examples of this (across industries) include:
- Customer Fraud. As personal situations are impacted by COVID-19, usually associated with a lower level of income, otherwise good people may act with more desperation. This increases the risk of misinformation and individuals fraudulently claiming available government/ business discounts or rebates.
- Employee Fraud. Employees personal circumstances may change and therefore they may be tempted to commit fraud if presented with the opportunity. For instance, if employees have revenue-based bonuses they may mis-sell products or falsely inflate prices to hit targets, leading to unwanted negative customer interactions. As customer facing processes have now changed, so must the control processes and associated preventive and detective controls.
- Credit Risk. Wholesale and Retail banking businesses are having to adapt as credit models have changed impacted directly by projections and impairments data. A big reason for this is payment holidays offered to retail banking customers.
- Almost overnight, non-essential staff are required to work from home. As such, IT security is becoming ever more imperative introducing risk questions such as; how secure are employee VPN and Wi-Fi connections, who else is in the property accessing the connection and who may have/ gain access to confidential customer information through weak home network security protocols.
- Business resilience between centres. Due to the global nature of COVID-19, companies with multiple international locations no longer have the framework or capacity, as previously available, to focus and support business functions in other countries.
Post COVID-19
Looking forward, Internal Audit leaders are challenged to fully and effectively address the following “new normal” working practices:
- Social distancing – keeping a safe distance will remain for some time. Understanding what works best in an office BAU setting requires considered assessment whereby team members may be subject to a rotating work force to ensure we can keep a safe distance.
- Transition to BAU – Internal Audit functions will be asking; “in a controls framework that has now changed, what is your risk position?” and how can we quickly and effectively adjust to the new BAU requirements.
- Flexible working – whilst flexible working has grown to become a regular offering in the market, Internal Audit leaders expect this to become more commonplace as we move forward. Striking the balance between effectively working from home and having virtual connections and face-to-face engagement will be a key focus.
We hope you found our analysis beneficial and would very much welcome your thoughts, comments and additional topics impacting you during COVID-19 which we can share with the wider Internal Audit community.
About Joseph Reeves
Joseph Reeves is Director at Francis King Ltd, London, UK. Francis King has nearly 10 years focused recruitment experience across multiple sectors within Audit & Finance roles in the UK and Europe.