Pandemic Brings New Risks, Opportunities for Internal Auditors

By Greg Enright


During the recent global pandemic, internal auditors have had to contend with a host of new risks and other, more traditional ones that have been altered forever. From IT systems to the way teams collaborate, nearly everything has changed. 


To help make sense of this new risk management landscape, Lenny Block, a consultant and former vice-president of internal audit at Nasdaq, offered his insights and advice during a recent Caseware webinar, “Auditing Office Culture in a New Digital World.”


“Internal auditors are always thinking about how we can add value, and our job got that much harder (during the pandemic),” he said. “We’ve had glitches and shutdowns before, but no one expected how much this would change everything.” 


Tools of the Trade


Almost overnight, internal auditors joined countless other professionals in a massive shift to remote working as the pandemic took hold in early 2020. This immediately introduced new risks related to companies’ computing infrastructures. Workers widely adopted videoconferencing and other online collaboration tools, for instance, as they set up shop in their residences. Pre-pandemic, a company’s IT system may have had to support 100 remote workers. “Now, will it be able to handle 1,000?” Block posited.


Workers’ abilities to carry out their responsibilities instantly became dependent on the quality of the wif-fi reception in their neighbourhood, creating an additional danger. “With so many locations, this becomes a higher risk profile that people have to take a look at.” 


Block added that security threats also tend to rise as people move out of the controlled confines of an office and into their remote workspace. “Phishing and ransomware increases with remote working,” he noted, adding that auditors must also worry about the security profiles of any contractors they happen to be working with and whether appropriate controls are in place for them.


New Business Models


Companies may also have to adjust their internal audit processes to account for radically altered customer business models. Pre-pandemic, for instance, most large retailers employed a hybrid sales strategy that included both brick and mortar locations and an e-commerce platform. The events of the past year, however, have led many to shift almost entirely to the online side. 


COVID-related shifts in their supply chains have drastically affected other industries. Rental car companies, Block pointed out, are dealing with a severe shortage of cars to offer customers. With little to no demand in 2020, they sold off much of their inventory. Now, they can’t replenish it because automakers saw vehicle production plummet. “You used to be able to rent a car for $69 a week. Today, if you can even find one, it will cost you three times that much.” 


The People Side


Ultimately, Block pointed out, an internal audit department is a professional services organization, and the quality of its work is dependent on the people who work within it. Ensuring that quality meets a high enough standard when everyone is working remotely presents a new set of challenges. 


One of them is ensuring that productivity levels stay as high as they did in the office. “If employees are distracted at home by their personal world — the dog barking in the background, catching the highlights of a soccer game on ESPN, a neighbour dropping by — all of that becomes a challenge,” Block said. 


The pandemic has also introduced new approaches — and dangers — in the area of talent acquisition. Given the increased importance of digital audit tools in the day-to-day functioning of an internal audit department, candidates with these skills and proven digital literacy may become more prized by employers. 


Auditors are also adjusting to a world in which new hires can be sourced from anywhere. With no need to be located in the same physical space as their co-workers, internal auditors can cast their talent acquisition net as wide as they like. A New York firm, for example, can now hire a great candidate from Phoenix. 


Drawing from a much larger talent pool is great, but concerns about keeping remote hires engaged when they are on the other side of the country or world can soon arise. HR can help by providing credits for such things as office equipment, home exercise machines, and online tutors for children studying at home. Managers can help by ensuring remote workers are included in discussions just as much as their office-based counterparts are.


The Post-Watercooler Era


Information-gathering challenges have also become a new hurdle to overcome, Block pointed out.


“Good auditors know how to get information out of auditees in a non-combative way,” he said. During his time at Nasdaq, he would often glean precious info from others while chatting about anything and everything by the watercooler or in the lunchroom. This is, of course, not possible in a virtual workplace. Being adept with collaboration tools like Microsoft Teams and placing importance on connecting with sources however possible will be key to success in this area.


What will be the new normal going forward? It’s still too early to tell, Block said, pointing to a wide variety of intentions around return-to-work scenarios put out recently by various sectors. The U.S. federal government has indicated a comfort level with having many of its employees remain in a virtual workplace, while some Wall Street banking behemoths like Morgan Stanley and Goldman Sachs have made it clear they want people back in the office as soon as it’s feasible. 


Block himself expects a hybrid model to become the norm. “It showed us that you can get a good amount of work done from home. But I do think that people need to come into the office if they can because face-to-face meetings are always better than virtual ones.”


You can view the full webinar-on-demand here.


Greg Enright is Content Marketing Manager at Caseware.