Side Effects of COVID-19: Internal Controls in a Time of Pervasive Change

More than six months after its initial onset on the global stage, COVID-19 is still ever-present and as we move into fall, health officials fear the potential “second wave” and the resulting spike. It seems almost overnight that entire industries shut down and work became remote for the indefinite future.
While many of us may not love the “new norm,” we’ve found ways to adapt both in our professional and personal lives. Now, when I leave my house, I repeat to myself, “Cell phone, wallet, keys AND mask." School systems have adapted to remote learning. Corporate board meetings once set in huge conference rooms have converted to multi-person video conference calls. We may not love all the changes, but frankly we are more adaptable then we ever imagined.
Similarly, gone are the days of “status quo” in the audit world. Year over year fluctuation analyses and analytics will be difficult to execute since the pandemic challenges the very nature of plausible and predictable historical relationships. The sustained impact to the economy elevates the risk surrounding impairment and going concern.
But what about internal controls over financial reporting? For an established company, internal controls are typically static year over year, with few minor changes. In 2020 however, arguably every company’s internal control framework has changed, whether it is as simple as the virtualization of monthly management meetings, or entirely new controls to adapt to new internal processes. As interim audit work begins this fall, auditors should consider the following factors when performing walkthroughs, assessing the design effectiveness and testing operating effectiveness of internal controls over financial reporting:
Changes to materiality, scoping and risk
Given many industries are experiencing significant declines in revenues, materiality for the 2020 audit may be significantly depressed compared to prior years.
- Are management’s internal thresholds used for controls sufficient to detect a material misstatement?
- For auditors, are there new significant classes of transactions and processes that fall into scope given lower materiality thresholds?
- Given the unanticipated economic impact of the pandemic, are there any significant or unusual transactions that require specific one-off controls to operate this year? Are there controls in place to address the accounting for these significant, unusual and sometimes complex transactions?
- Was there an acquisition or a divestiture? Did the company discontinue an operating segment or reorganize?
- Did the company obtain a PPP loan or other forms of debt and financing?
- With changes to companies’ operations, are there new risks that have emerged?
- With the move to automation and more virtual operations, do IT controls have more importance in 2020?
- Are there more elevated risks of cyber-security?
Changes to the design of internal controls
The virtualization of the corporate world is forcing companies to redesign many controls. While a monthly management meeting that went from in-person to remote may not pose much of a concern for auditors, there are a number of other controls that would change if virtualized. Less automated companies for instance might still use hard-copy reviews and approvals over invoices, account reconciliations, journal entry support, cash receipts and check payments, etc.
- How were these controls modified to adapt to remote work?
- Were hardcopy papers simply scanned or were new applications developed and implemented to allow for automated system approvals?
- Were controls operating effectively for the entire period or were there different controls for different periods (i.e. pre-COVID controls and post-COVID controls)?
Changes to inventory controls
Tangible inventory often requires in-person processing, whether it be picking and signing off on packing slips, loading trucks for delivery, or performing regular inventory cycle counts.
- How did these processes and, in turn, the design of controls, change in 2020?
- Did the company find creative ways of performing remote counts?
- Was there a lag in the controls for a period of time?
- If inventory cycle count controls were halted for a couple months during transition, does the original design of the cycle count (which should inherently ensure all items are counted every year) need to be modified for the remainder of the year?
- Does the company need to perform an annual count this year?
For the auditor, how can the engagement team “observe” an inventory count if everything is remote?
- Could the engagement team rely on virtual counts using video conferencing techniques?
- Could drones help count stockpiles of inventory?
- Does the auditor need the company to perform an annual count this year?
Changes to control owners
At the start of the pandemic, the headlines seemed to read nothing but increases in infection rates and unemployment rates. Many companies have indefinitely furloughed employees and reduced headcount, operating at bare bones capacity, attempting to financially weather the storm.
- How did reductions in headcount impact controls?
- Were control owners re-assigned?
- Are there any segregation of duties concerns?
- Were any controls forgotten or just fell through the cracks?
- If tasks were reassigned based on reduced headcount, do control owners have sufficient time to perform all the controls with an appropriate level of precision?
Changes to timing of controls
Change takes time to implement and, with limited resources, how was the timing of controls impacted?
- Are monthly controls now being performed quarterly?
- Are controls being performed timely within the standard close period?
- Was there a lag in controls being performed when the pandemic first started (which was right around Q1 for most companies)?
- Has any backlog in controls been remediated?
While the questions above relate to internal controls, don’t forget to then consider the impact on the substantive audit. If there are gaps in controls or deficiencies identified, the substantive audit approach should be modified to address the non-reliance, even if just for a couple months.
With a list of questions this long, I’m certainly not implying that every control will be new, modified or deficient. No, but we face an atypical year with pervasive changes throughout most businesses. It’s important that companies and audit teams consider the various implications in assessing the design and testing the operating effectiveness of controls in 2020. For teams that are starting interim procedures, these are important questions to guide conversations with clients and to understand the evolution in the control environment year over year. The sooner these discussions occur, the more time there is to ensure controls are designed and operating effectively and confirm there are no material weaknesses that could drastically change the audit approach.









