Don't panic: keep a cool head in a crisis

The coronavirus has changed everything. This is not, and cannot be, business as normal. So what can internal auditors do to help their organisations and their people during these incredibly stressful and difficult times?

For a start we must think differently. In the past few weeks audit teams across the UK and Ireland have been adapting to a whole new risk profile for their businesses while working remotely. Chief audit executives (CAEs) are being challenged to provide assurance in an agile, fast-paced manner while boards take decisions that could result in the success or failure of their businesses. Audit teams need to be adaptable and change the ways they undertake audit procedures. If organisations introduce pragmatic, interim control solutions to mitigate the greatest risks, internal auditors will have to think carefully and quickly about whether these are good enough.

Some processes and procedures will fall by the wayside and people under pressure will make mistakes. We cannot add value and gain respect from our colleagues and senior managers if we fail to understand that, for many organisations, this is an existential crisis. If the most useful thing we can do to keep an organisation afloat is to man phone lines, then that is what we must do, regardless of our normal roles or independent status.

I used to work for an organisation with an office at Staines. When the Thames flooded, internal audit helped pile up sandbags with everyone else to save our main servers. There was no point asking managers at that point why their crisis plans were inadequate.

Beyond fighting on the front line, we need to focus on how we can help businesses to recover. Most plans will now be redundant and the risks we focus on for the rest of the year and beyond may be very different from the ones we predicted a month ago. Normal audit evidence may not be available and the normal level of audit procedures may not be possible. CAEs will rely more than ever on their judgment combined with the evidence they have and this will challenge many who are used to detailed audit work which takes a long time. 

Breadth versus depth of audit work will also be important – there is no point spending lots of time on one risk area while totally missing another.  The ability to scan the horizon to pull out the deal breakers for the business will be critical.

Talk to the audit committee and senior managers to work out the main risks today. Which regulations and policies are most important? What audits can be dropped? How much can you do with, say, half your staff off sick – and no ability to co-source.

Some things will slip; don't expect accounts to be released on time or external audits to happen on schedule. Identify the pragmatic reactions that will mitigate the worst consequences of policies or processes that fall by the wayside.

Decision-making is crucial. Some people will have to make decisions on the ground and these may not be the usual decision makers.  Trust your staff and create a framework for rapid, emergency decisions. Who is accountable if someone on the front line makes a decision? What processes are there to support them and guide them? What happens if they make a mistake?

Communication is vital.  We need to reassure managers that they can trust the underlying governance structure. We need to tell them what we can do with limited resources and that we can learn from mistakes and mitigate any problems that occur.  We don't know what tomorrow will look like, but we need to help ensure our business will still be there.

Above all, this is a moment when auditors need to demonstrate empathy. Don't stand aloof and blame others for past or present mistakes. We have an opportunity to build enormous credibility and respect if we understand the situation for the whole organisation and offer a clear perspective. At times of isolation we need to talk more – let people know what we are doing and why and what decisions we are making on what evidence. Above all, we need to recognise the emotional consequences of the pandemic. People are scared for their jobs, their families and their communities. They are not going to compartmentalise these fears and focus on work normally. These are not normal times.

This article was first published in May 2020.