No one can predict the full impact of COVID-19 on the economic environment. Organizations must continue to adapt and learn how to effectively operate while ensuring the safety of their employees, customers and other key stakeholders. That means understanding the particular importance of internal controls during COVID-19, continuing to confirm compliance with Sarbanes-Oxley 404 (SOX) and revisiting priorities as plans are made for upcoming quarters.
Inevitably, companies will try to reduce costs in order to compensate for profitability shortfalls due to business interruption related to COVID-19. Some may consider diverting resources away from internal controls, shifting them to other operational issues, or they may even delay internal controls reviews. Now is not the time to divert internal controls resources or delay internal controls reviews.
In fact, it’s actually a perfect time to reexamine internal controls. Here are a few reasons why:
1. Economic uncertainty often opens the window for fraud.
Fraudulent activity tends to rise during times of economic uncertainty. Disruption to business processes and controls may cause organizations to become more susceptible to internal and external fraud. Employees of a disrupted business may believe it is more acceptable to circumvent some of the key internal controls that were designed to help mitigate risk.
To help combat this potential increase in fraudulent activity, the executive team must ensure their organization continues to diligently monitor internal controls. In fact, the controls currently in place may require further review to determine if they are still effective and adequate.
2. Evaluating risk may lead to new or modified internal controls.
The effect of COVID-19 has created an unprecedented level of business interruption around the world. Many organizations have had to shift to working remotely and adjust operations to ensure the safety of their employees, customers and other key stakeholders. These adjustments may have caused material changes to financial reporting or business processes. Certain risks may have increased, and new risks may have developed.
Management is advised to reevaluate financial reporting risk and assess the impact of any noted changes on internal controls. This will require that the executive team revisit previous risk assessments and focus on key SOX areas, including the following:
- Financial Reporting
- Revenue
- Expenditures
- Technology
- Human Resources
Financial Reporting
As a result of the shift to working remotely and new social distancing guidelines, many close activities will now be done virtually. It is important for your team to maintain the same level of integrity during a virtual close to ensure accurate financial statements. Management should continue to review journal entries and confirm account reconciliations are up to date and reviewed on a timely basis.
Additionally, estimates and other business assumptions should be reviewed to ensure they are still reasonable in light of the COVID-19 crisis. For example, sales may decline, inventory levels may be higher or perhaps customers are paying more slowly. These types of changes due to COVID-19 may require adjustments to reserves, accruals and other asset valuations.
The government and regulatory agencies are monitoring the economic environment and introducing new laws and adjusting filing deadlines. Financial disclosure should be updated to highlight areas materially impacted by Covid-19. The Financial Reporting team must monitor these areas.
Revenue
Key areas in the revenue cycle should be evaluated for COVID-19 impact. Pricing and cash collections are two important control areas often tested in the revenue cycle. Organizations should reach out to their key contacts to understand how they have been impacted by the crisis. It is important that Sales, Marketing and Accounting teams stay apprised of any changes in sales discounts, payment terms or any other concessions offered to customers.
Organizations should also monitor cash collections and cash applications to understand any processing delays due to COVID-19. It is similarly important that they uphold the internal governance process to approve changes and documentation is retained. Also, any modifications should be communicated to all key stakeholders so the impact can be rolled into their areas.
Expenditure
Key areas in the expenditure cycle should be evaluated for COVID-19 impact. In particular, impact to the supply chain should be reviewed. Companies should contact key vendors including outsourced service providers to understand the impact to their businesses and ensure they will still be able to provide goods or services in accordance with executed contracts or service level agreements.
Also make it a point to understand any internal control changes vendors have implemented and determine if any action or additional monitoring is needed by your organization as a result of COVID-19. Explore alternative vendors and suppliers if necessary.
Technology/Remote Work
Management should ensure the organization has the proper infrastructure to support remote work.It is important to put controls in place for granting remote access and to secure confidential information while employees work remotely. Employees should not try to work around existing security protocols.
Management should also check in with IT to make sure any additional work as a result of COVID-19 is not impacting the completion of regular key controls. These include monitoring interfaces, performing testing prior to moving updates into production and working with Accounting to retrieve data for audit testing.
Human Resources
As a result of COVID-19, there are a number of new risks in the Human Resources area. The Human Resources department must work with company leaders to ensure that consistent COVID-19 communication is shared throughout the organization.
Certain Human Resources processes such as onboarding and terminating employees may need to be modified. For example, if an organization is working remotely, a new protocol may be needed to remove access and collect laptops and other company property from terminated employees.
Human Resources will also have to develop new policies/protocols to follow if an employee contracts the COVID-19 virus. Further, Human Resources will need to work with the Facilities department to ensure office workspaces are in compliance with any new health and safety guidelines introduced due to COVID-19.
3. Modifications to key internal controls during COVID-19 should be documented.
Any modification of key internal controls during COVID-19 should be documented and available for audit or SOX testing. With continued uncertainty in the economic environment, consideration should also be given to process modifications needed for the remaining quarters in the year. For example, controls may need to be reassigned because an employee is out sick or information is not available to perform a control test remotely. Or perhaps operations were closed, and a certain control was not done for a period of time. It is important that any deviations from normal controls be formally documented and that evidence of any alternative control procedures be retained.
4. Effective early communication with external auditors helps improve the audit process.
Good communication with external auditors is always critical for any organization. During these rapidly changing times, it becomes even more so. As organizations reassess risk and modify controls, auditors should be kept in the loop. Open and ongoing discussions with them are key.
If auditors have an understanding of changes and gaps in internal controls during COVID-19, they will be in a better position to plan their audit approach and allow the organization to better prepare for audit testing. This understanding should also help minimize additional audit fees and avoid surprises later in the year.
A Good Time for a Closer Look at Internal Controls
Given the added importance of internal controls during COVID-19, now is a good time for a closer look. Take this opportunity to make the internal controls function more than a compliance function mandated by SOX regulations and to provide organizational leadership on control guidance. Management remains ultimately responsible for providing shareholders, investors and other key stakeholders with accurate financial statements. A strong set of internal controls will go a long way toward instilling confidence in their accuracy.
If you’d like an experienced, objective consultant to take a closer look at your internal controls and suggest improvements, please reach out to 8020 here. We’d be happy to help you navigate today’s challenging times and prepare for the post-COVID future. You can learn more about our Interim Controller Services by downloading our free guide below:
