​Initial Pandemic Responses Didn’t Leverage Internal Audit

In last week’s blog post, I made the case for internal auditors to step up and demonstrate their value ahead of the looming recession. A new Quick Poll by The IIA’s Audit Executive Center (AEC), which looked at how organizations have reacted to COVID-19, provides a decidedly mixed picture of internal audit’s role in the time since the World Health Organization declared it a pandemic.

While most chief audit executives surveyed reported that they are now involved in their organizations’ responses to the coronavirus, 37% said they should have been brought in sooner to discuss the risks and potential responses. Only slightly more — 43% — felt they were involved in a timely manner.

A clear correlation was found between internal audit function size and the timeliness in which they were involved. Respondents in smaller internal audit functions expressed the most concern, with nearly half (48%) saying they were not involved in a timely manner. Concerns expressed about the timeliness of involvement decreased progressively for larger functions, with respondents from the largest (26-plus employees) expressing the least concern (23%).

Not surprisingly, organizations focused initially on assessing immediate impacts. From the Quick Poll report:

• Strategic: Initial strategic responses were focused on assessing short-term impact (78%) and communicating with the board (72%).
• Financial: Among survey respondents, four in 10 said their organizations had closed locations, explored short-term cost reductions, or reduced operations.
• Employee-focused: Nearly every respondent said their organizations had implemented remote work for employees (96%). And while travel has been severely curtailed since the quick poll was conducted a week ago, at the time, seven in 10 said they had restricted travel, and nearly five in 10 said travel was eliminated.
• Customer-focused: Many organizations had developed a communication strategy for customers (82%), but less than half said they had developed new policies for customer health and safety.

While findings about the timeliness of internal audit’s involvement are concerning, the poll also provides data that suggests there are opportunities for internal audit to provide ongoing support through insight and foresight. For example, only about half of respondents (51%) reported their organizations had performed a detailed assessment of long-term impact, and less than half (45%) reported a review of strategic plans with management. Those two areas will be significant as organizations around the world manage the ongoing risks related to COVID-19 and economic turmoil.

Another data point identifies an opportunity addressed in last week’s blog post. While much of what I wrote focused on internal audit support for short-term cost reductions ahead of an economic downturn, it included an important caveat:

However, it is important to recognize that many cost-saving actions can impact future risks. Cutting the wrong costs can result in subjecting the organization to unacceptable risks in the future. There needs to be a balance between needed cost reductions and effective risk management going forward (e.g., sufficient internal controls over contracts and vendors).

The quick poll found just 25% of organizations had explored long-term cost-reduction strategies. That presents another opportunity for internal audit to provide foresight that will help shape how their organizations plan for recovery and ramp up production once the pandemic subsides.

While the poll was performed under the AEC, the results are available to anyone. Respondents were from North America (U.S. and Canada), but I believe our findings provide important benchmarking data applicable to organizations essentially anywhere. I encourage all of my readers to take a look at the report. It and several other valuable resources are available now on The IIA’s new COVID-19 Resource Exchange on both our North American and Global websites.

As always, I look forward to your comments.