View from IIA Global: Internal audit’s response to COVID-19
So far in the Covid-19 crisis, internal audit has shown impressive agility not only in modifying audit plans and contributing to assessments of new risks, but also by temporarily redirecting staff to assist in non-audit work.
Recent polls by IIA Global’s Audit Executive Center (AEC) show the extent to which internal audit functions are helping their organisations to respond to the crisis, including helping to prepare workplaces for employees’ return to work. Although the results are specific to the US and Canada, internal auditors in the UK and Ireland – indeed, worldwide – face the same risks and are probably reacting similarly.
One of the AEC’s surveys, of 371 internal audit executives, found that more than half of their organisations were not well prepared for aspects of ensuring a safe return to the workplace. These included activities directly related to Covid-19 transmission, such as testing and disinfecting workplaces, as well as evaluating potential organisational liability for employee illness or death.
Nearly three-quarters of respondents (72 per cent) said they were identifying emerging risks and updating risk assessments, while two-thirds were performing consultancy activities to prepare their organisations to return to work. But few internal audit teams were reviewing firms’ readiness to return to work. Only ten per cent were performing reviews related to human resources,15 per cent were overseeing reviews related to third parties, and 8 per cent were performing reviews related to health and safety.
It’s troubling that so many respondents (more than 16 per cent) could not comment on their organisation’s readiness for a third of the 19 key factors to consider for returning to work, including legal liability and testing. Too many internal audit functions are not being invited to help address some of the biggest risks their organisations are confronting. This is unacceptable, considering that risk assessments should have been updated to cope with the crisis.
Different industries had different levels of preparedness for returning to the workplace. Nearly two-thirds of respondents in manufacturing said their companies were well prepared, followed closely by respondents in utilities, transportation, construction and agriculture (62 per cent).
More than half the respondents in the healthcare and social assistance sector (56 per cent) and in finance and insurance (54 per cent) said their organisations were well prepared, but just 40 per cent of those in educational services said the same. Internal audit leaders in public administration were most likely to answer “not sure” when asked whether their organisations were prepared for factors related to returning to work.
Nearly four in five respondents said their companies were well prepared to disinfect workplaces (77 per cent) and implement personal hygiene policies (79 per cent), but just 42 per cent said they were ready to modify workspaces for social distancing. Only 21 per cent said they were prepared to test for current infection. Fewer than half of the respondents (48 per cent) said their organisations were ready to provide personal protection equipment to returning workers.
Most comments from respondents reflected high levels of involvement in key committees, meetings and activities focused on preparing for a return to the workplace. However, there were also worrying examples of internal audit being excluded. In one case, most of the internal auditors were laid off after the CFO rejected the need for a business continuity plan.
A previous survey of more than 400 internal audit executives showed that internal auditors were making other contributions, including taking on special assignments, such as projects to identify cost savings, expense tracking and risk mitigation.
More than a quarter (28 per cent) of respondents reported moderate to extreme concern about their organisations’ long-term financial viability. Most said that staffing and budgets had not been severely impacted, although 40 per cent in consumer-facing organisations said they faced staff cuts.
Overall, the internal audit function appears to be playing a significant role in this crisis, however there is more disruption ahead. We cannot be left out of efforts to manage key risks at this critical time. When asked“Where was internal audit?”, we must have an answer. It’s not too late to remind management and boards of the value that internal audit can bring to health and safety reviews in response to this ongoing pandemic.
This article was first published in July 2020.