Chief Audit Executive and the Audit Committee: no surprises in surprising circumstances

Following the guidance on independence and objectivity, this piece addresses one of the consequences of the coronavirus crisis: the audit opinion. This could arise from changes to the annual or periodic plans, limits to engagement scopes, or even internal audit resource used to help the first and second lines.

Everything comes down, as is often the case, to regular and transparent communication. If this has been the norm before this crisis, then that is one business-as-usual practice you must continue. If not, the fact that everyone is now working differently may open them up to new ways of communicating.

However, lines of communication may falter or reporting lines may change if senior contacts and decision-makers are unwell or unavailable. If this is the case, what is the contingency plan to ensure sound governance? This should be part of the organisation’s business continuity plan, which may be strained to its limits currently.

If everyone is available but working remotely, it may improve communication with the most senior people. After all, audit committee members – and other directors – are unlikely to be travelling or even leaving home right now. They may therefore be far more physically present – albeit via a telephone or broadband link – than under normal circumstances.

Take advantage of this extra time to set out:

• what is happening across the organisation?
• how well specific key controls are holding up?
• risks and opportunities of the crisis, and
• how internal audit is responding constructively to the situation.

This is not just an opportunity to demonstrate internal audit’s role and value to an organisation; it’s a chance to set a new standard in open, clear communication. You may normally prepare lengthy, possibly wordy PowerPoint presentations or reports as part of a regular update to the audit committee. Over Skype or Zoom, however, you can speak plainly and clearly. It’s not about being unprofessional – it is about using this unique situation to re-set how senior decision-makers receive and discuss critical information.

What is that critical information? Emerging or increasing risks, of course, as well as any changes to the plan. The chief audit executive (CAE) must inform the audit committee – and in many instances seek their approval – of changes. No surprises! Committee members are sure to be sympathetic not only to any necessary reductions in activity or scope, but also to internal audit’s desire to help the organisation.

They will want to know the criteria for such changes, and how internal audit may be relying more than usual on other assurance providers, where appropriate.

When it comes to the remaining internal audit engagements on the plan, will any of them require changes to or reductions in scope? If so, how may this affect the overall audit opinion? What work is critical to providing an opinion, and what is additional or less essential?

Some CAEs may consider issuing a limited or qualified opinion as a result of changing the annual plan. However, the Institute’s advice is that if the audit committee has agreed to the changed plan, there is no need for a limited opinion: the opinion will reflect the work detailed and agreed, nothing less:

You could reasonably say that internal audit is prepared to provide an opinion based on 80% of the work completed due to COVID-19. That opinion is either satisfactory, needs improvement, or whatever language you use.

It’s about flagging up that you have done a limited amount of work and therefore the opinion is based on that limited amount of work. You can say that within that 80% you did not cover certain risks and therefore can give no opinion on those risks.

Similarly, a qualified opinion is warranted if the results of your testing lead you to it – if you would have issued a qualified opinion anyway, under normal circumstances.

The previous guidance about remote working during this crisis mentioned how many elements of an audit engagement we can routinely cover electronically. Right now, data analytics and other CAATs, as well as resources such as video links and screen-sharing (for physical observation and process walkthroughs) can enable you to cover almost as much as you would normally. If you can use these technologies to gain sufficient coverage, and you feel confident your opinion reflects the true position, there is no need to qualify or limit your conclusions. You may wish to note any gaps in testing, but unless these materially affect your scope, you should be confident in your work.

Again, communicating clearly what you’re doing and why will give the organisation confidence it can rely on internal audit’s work. Senior managers in the areas audited should understand why there are changes to what they agreed in the terms of reference. Audit committee members and other directors will see the coverage they’ve agreed in amended plans. Limitations and compromises are inevitable in the current crisis – surprises aren’t.

Further reading

Implementation guide - Standard 1111 – Direct Interaction with the Board

Guidance - Working with stakeholders

External resources - ACCA Internal Audit eBulletin : ‘Effective communications - conversations with Non-Executive Directors’