Guest blog: Claire Ashby CIA, QIAL, FCA, Head of Internal Audit London’s Southbank Centre and the National Theatre
On the 16th March 2020, the government asked all UK theatres to close their doors. To an industry whose offer is mass indoor gatherings the devastating impact of Covid-19 was immediately apparent.
As the head of internal audit for a number of theatres and performing arts organisations, I found myself in unprecedented territory. As management addressed the immediate tasks of securing the buildings and setting up remote working for staff, audit committee chairs were asking what role internal audit should play over the next period and I began grappling with providing assurance for organisations that are effectively in hibernation.
Whilst in some sectors business has continued, albeit remotely or with different working practices, the theatre and leisure sector has come to a standstill. For my client organisations around 85% of the staff are furloughed. Buildings have been mothballed and a skeleton staff are working to keep artistic collections secure, modelling future scenarios and provide vital HR and finance support.
My immediate priority was to understand the new profile of operational risks, which if not effectively managed, could further harm the business and potentially tip it over the edge.
Undertaking a rapid assessment of the new operational risk profile became an imperative and then providing some immediate comfort to audit committees that these issues were under control.
For these hibernating organisations, top operational risk areas include:
- keeping sites and invaluable works of art secure when buildings and whole city districts are deserted
- health and safety risks for security staff on site both in the context of lone working and the potential for Covid-19 outbreaks
- remote operation of financial controls especially for rapidly changing payrolls
- remote operation of theatre box offices with staff working from home to refund millions of pounds of tickets for cancelled performances
- operation of furlough schemes in accordance with HMRC requirements
- cyber and data risks associated with remote working and technologies.
In the history books, you must go all the way back to 1642 and the English Civil war, to find the last time theatres were closed by the UK government. They didn’t reopen for 16 years.
Theatres are anticipating they will be the last to re-open, albeit many are planning for 2021 rather than 2036. The government allowing re-opening is only one factor, the timeline will be dependent on when audiences are confident to return and performances again become financially viable.
There is a huge question as to whether many organisations can survive long enough. I am optimistic that organisations who thrive on creativity and ingenuity will find a way through. With this outlook, I am beginning to plan for the assurance which will be needed once re-opening timeframes become clear. How will senior teams and governing bodies be sure that critical tasks have been completed before performers and the public return? Health and safety will, be a key area for all organisations not only for theatres where assurance will be required, I believe, answering questions such as:
- Are the buildings safe to open? Has maintenance on critical systems such as fire alarms and lifting systems lapsed during hibernation?
- How will the organisation comply with government guidance on social distancing and use of PPE?
- How will staff welfare and training in new requirements be managed during the return to work?
Assurance may well be needed over key functions that were previously thought to be well controlled. Has the control environment been adversely impacted by transitions to and from the office or due to loss of staff? Opportunities for efficiency using technology adopted during lockdown must not be lost but may also need re-assessment when staff are back in the workplace. I am considering a series of focused health checks of key controls in the core functions in order to quickly give a view on any adverse impact on the organisations control environment and highlight issues that need attention.
There will also be many longer-term impacts of the crisis which will need to be considered by internal audit. Changing expectations of audiences, shifting relationships with partners and new working practices for staff will all impact the new risk universe. Many arts organisations have adapted to lockdown by offering their content online from streaming of theatre productions to remote tours of art exhibitions.
This has been embraced by new audiences, with for example the National Theatre’s You Tube streaming of “One Man, Two Guvnors” being seen by 2.5 million viewers. The production would need to be played in the theatre’s largest venue every night for 6 years to achieve the same audience live. Whilst audience expectations may have shifted, the financial, legal, and technical issues associated with live streaming have not. This is just one example of new opportunities, challenges and risks that firstly management and then internal audit will need to factor into their plans in the months and years to come.
