Returning Internal Audit to 'Business as Usual' in a New World

Given these upheavals in “business as usual,” internal audit departments within financial services institutions have been forced to pivot quickly, reprioritizing and adjusting their audit plans on a dime. This has resulted in the delay, deferment and even cancellation of many internal audit plans and activities in 2020.

At the same time, COVID-19 has introduced new risks (e.g., employees working remotely, workplace safety), as well as new components to existing risk areas (e.g., supply chain sustainability, customer experience and service). These developments have forced internal audit departments to free up capacity and shuffle resources to focus on these emerging priorities. Also, many financial services organizations restructured their 2020 audit plans significantly, perhaps more than at any other time in recent history, and, in some instances, created a backlog of critical or key audits.

Despite the many challenges, internal auditors globally have shown remarkable agility and resilience. For instance, in a recent survey of more than 1,500 internal auditors from 95 countries, The Institute of Internal Auditors (IIA) notes that, in response to COVID-19, more than half of all functions updated audit plans, reviewed risk assessments and worked on identifying emerging risks. The full results of The IIA survey are published in this paper, COVID-19: The Initial Impact on Internal Audit Worldwide.

Going into 2021, as the risk landscape continues to evolve, internal auditors can no longer rely on traditional, monolithic approaches. Today’s dynamic environment requires new approaches and thinking. In this paper, we offer eight key recommendations for internal audit departments in financial services institutions that have experienced major upheavals, with the goal of enhancing the effectiveness of internal audit and the ability to provide assurance on risk management and controls during a rapidly evolving economic environment.

Recommendations for Addressing the Impacts of COVID-19 on FSI Internal Audit Plans

Each internal audit function faces its own unique challenges based on the size of the financial institution, its customers and clients, the complexity of its business, and the effects of COVID-19 on the organization. Internal audit’s view of the effects of the pandemic and the way forward for the organization should be validated with the audit committee and executive leadership.

The following recommendations should be considered, in part or in whole, while keeping in mind the specific circumstances of each financial services institution. In many instances, employing next-generation internal audit governance, methodologies and enabling technologies will provide a significant advantage.

• Commit to becoming an adaptable internal audit function: Utilizing traditional, monolithic approaches to auditing dynamic and changing risks is no longer acceptable. Given the greater prevalence of data in financial services institutions, internal auditors need to deploy methodologies and tools that provide for the capture and analysis of data, turning it into insights as close to real-time as possible. These next-generation internal audit efforts require an internal audit culture that embraces change as well as agile, analytics-driven and scalable execution.
• Transition to a dynamic risk assessment approach: Given the current business challenges and risks, internal audit functions should transition their focus from a static, traditional cycle-based model to a dynamic risk assessment approach – a key element in a next-generation internal audit function. Shifting to a proactive, dynamic methodology, during which audit hours typically are focused on executing projects, versus a cycle-based approach (e.g., semiannual, quarterly), will enable organizations to:
  • Identify changing risk trends in real-time.
  • Re-prioritize coverage of risk as changing trends are identified.
  • Develop an ongoing and common view of risk and the integrated assurance map across the three lines of defense.

Additionally, audit organizations that have adapted their risk assessment approach to quantify risk more effectively on a real-time basis and have executed relevant assurance work to align with key organizational risks and priorities have navigated the pandemic – as well as the resulting changes in business and risk – more successfully than those organizations without these capabilities.

• Identify and prioritize which backlogged audits still need to be completed: In the wake of the pandemic’s onset, many internal audit departments were forced to place prescheduled audit activities on the back burner due to rapidly shifting priorities and redeployed resources. According to The IIA’s recent survey, about half of the more than 1,500 respondents reported cancelling or reducing the scope for some audit engagements in response to COVID-19. Now is the time to review this list of backlogged projects and begin prioritizing based on risk type, resource availability, stakeholder feedback, regulator focus, established requirements and other factors. Once a prioritization methodology is developed, internal audit should adjust or revise the existing audit schedule based on the output of this exercise. The review is essential as it may provide insights into audits that may no longer be worth pursuing given the changed environment or into those audits that were managed remotely and whether there are lessons to be learned from the remote-audit work process.
• Revisit opportunities for automation: Next-generation internal audit technologies have become more critical amid the current challenging business and working conditions. Going forward, internal audit leaders should determine if initiatives and investments to incorporate more automation into the audit process were put on hold and, if so, assess if they can be implemented. As part of the considerations regarding automation, the focus should be on high-volume transaction areas with mature control environments, for which first-time investments in automation can reap the most benefits. (For further insights, see the sidebar, “Empowering Next-Gen Internal Audit With Advanced Technologies,” below.)

Now is the time to review backlogged projects and begin prioritizing based on risk type, resource availability, stakeholder feedback, regulator focus, established requirements and other factors.

• Assess resource capacity: Making sure you have the right skills, capabilities and capacity is essential to ensuring you can provide assurance over risks that are changing at an increasing velocity. Resources have been put to the test during the COVID-19 crisis. In many cases, internal audit staff were moved to the first line to provide support with COVID-19 response and customer service activities, contributing to delays in prescheduled audit activities. Staff reductions have also impacted internal audit functions, although at a lower scale compared to budget cuts. Globally, internal audit staff reductions have been most severe in consumer-facing businesses, such as retail, food and travel, The IIA survey shows.
  Going forward, internal audit functions should assess current and forecasted resource and skillset capacities to ensure that resources are available to address the most critical risks, including new and emerging risks resulting from the pandemic as well as those risks inherent in the business. Aligning existing resources against the highest risks and internal audit plan (including backlogged audits) and then augmenting where necessary will help ensure organizations can fulfill the mandate to provide assurance over key risks and controls. In addition, consider potential conflict-of-interest risks prior to assigning resources to execute certain audits of first-line business functions that, at the onset of the crisis, borrowed third-line resources to support COVID-19 response and customer service activities. Audit leaders should have clear visibility into which individual employees were pulled for these first-line activities (including the specific timeframes and scope of this support) in order to ensure that related audits are staffed with properly independent resources, including those of third parties, as necessary.
  As part of these efforts, internal audit leaders also should continue to focus on achieving aligned enterprise assurance. There are numerous risk management disciplines within financial services institutions. Internal audit can assume a key role in leading the discussion to align them and overcome obstacles assumed by the traditional three lines model. Next-generation internal audit groups seek consistency among the three lines in taxonomy, rating scales and language, and break down silos to establish a consistent message and voice and achieve organizational efficiencies in risk management.
• Recognize your people: In these tumultuous times, it is important to acknowledge your people and their efforts. Most staff members likely have been putting in extensive hours to conduct auditing activities while working remotely and amid changing business conditions. Take the time to express appreciation for everyone’s contributions and encourage people to catch up on vacations and recharge. Promote a flexible work schedule when possible and make sure to build in frequent touch points with team members, both as a group and individually.
• Increase frequency of communication with the audit committee, executive leadership and working groups: Amid the current environment, one of the areas likely to see a continued change is the process by which internal audit functions partner and communicate with executive leadership to identify and monitor the organization’s overall risk. Chief audit executives and internal audit functions that have not already been communicating with their audit committee and/or executive leadership on at least a monthly basis should prioritize increasing the frequency of outreach to this level and consider whether different forms of communication and reporting are needed. For example, are live virtual meetings an option? More frequent communications, the content of which will likely evolve over time, will provide needed transparency into changing business conditions and new risks to address in the audit plan.
  In addition to maintaining awareness of the broad range of issues the financial institution may be facing, audit leaders should participate in enterprisewide working groups and committees focused on addressing and responding to the challenges presented by the pandemic. These frequent touch points will help ensure that there is alignment on expectations and views of risk throughout the organization.
• Consider the regulators: During these times of uncertainty, it is equally important to keep the lines of communication open with regulators and examination teams. In this dynamic environment, legislation is being passed at a rapid pace. We have seen this with new government programs and regulations worldwide, as well as from various U.S. state insurance regulators, all designed to stimulate the economy, aid consumers and address the pandemic. Regulators are updating guidance and examination schedules and guidelines in real time. They have also had to shift their methods of communication and coordination among different agencies while adjusting to a remote working environment. They will likely welcome an open dialogue around an organization’s current challenges and priorities given the breadth and depth of the pandemic’s impact.
  Now is the time for internal audit leaders to leverage their long-standing relationships and partner with the financial institution’s regulator, up to and including sharing proposed internal audit calendars and action plans to ensure robust and transparent communication. Regulators may look to place additional reliance on internal audit functions in the near term to ensure that an organization is managing and monitoring associated risks of the pandemic.

Now is the time for internal audit leaders to leverage their long-standing relationships and partner with the financial institution’s regulator, up to and including sharing proposed internal audit calendars and action plans to ensure robust and transparent communication.