The business disruption associated with the COVID-19 virus is both unprecedented and extraordinary. As financial markets in the United States see record declines, financial institutions find themselves in the unique position of seeking to execute pandemic plans, while preparing for potentially robust activity as a delivery channel for the U.S. government’s massive stimulus package.
As such, internal auditors of financial institutions find themselves in an equally challenging position, assisting management with “all hands on deck” while seeking to maintain objectivity and keep the audit process moving forward.
In doing so, there are a variety of unique considerations for internal auditors, which might include:
Audit Universe – internal auditors should seek to determine if their “audit universe” has changed since initial risk assessment. The pandemic response might not result in new business processes but it could certainly result in more relevant sub-processes. The ongoing and post COVID-19 environment may produce both short and long-term changes in the audit universe of financial institutions.
Risk Assessment – while the current environment does not lend itself to a formal risk assessment, internal auditors should consider whether there are certain business processes (or component units) that present unusually higher inherent risk. Examples might include the unique challenges of processing a substantial volume of loan payment deferrals or a significant increase in loan volume related to SBA lending. In addition, consideration should be given to those processes where internal control risk may be uniquely impacted by the pandemic, such as the modification of the design of certain controls to accommodate a remote workforce.
Audit Plan – internal auditors should stay focused on executing current audit plans so as not to leave an insurmountable task on the other side of social distancing. However, consideration should be given to taking a proactive role in assisting management during this unprecedented time. In addition, the heightened and unique risks identified by informal risk assessments should receive priority in the modified plan.
Business disruption – this crisis represents a massive business disruption for management, employees, customers, and the internal audit function. Internal auditors should be considerate of the impact on auditees and be agile in adapting to the changing environment.
Regulatory Considerations – internal auditors should seek to stay current on the regulatory response to COVID-19. Guidance issued on subjects such as Troubled Debt Restructurings and Current Expected Credit Losses (CECL) can have an immediate and significant impact on financial institutions and should be “top of mind” for internal auditors as they navigate these uncertain times.
Communication – proactive, clear, and concise communication with relevant stakeholders is paramount both during and subsequent to the crisis. Internal auditors should evaluate the nature, timing, and extent of communications with executive management, the Audit Committee, and regulators.
COVID-19 presents an extraordinary challenge for both financial institutions and their internal auditors. If chaos does in fact create opportunity, there has never been a more clear opportunity for internal auditors to lead. If your financial institution’s internal auditors are unsure of next steps, contact a CRI advisor for more information and guidance.