With coronavirus dominating every aspect of life, organisations are quickly adapting how they operate. Internal audit functions are of course no exception.
This piece of guidance addresses the question of maintaining independence and objectivity. Internal audit combines a broad understanding of the organisation with specialist skills and expertise in many diverse areas, including IT, risk management, actuarial science, operations and accountancy.
It is therefore not surprising if a resource-hungry first line calls upon internal audit for help. Internal auditors themselves will want to do their bit to assist the organisation in a more direct way in its hour of need. How can we be of most use to the organisation, without compromising our independence and objectivity?
Consider first what the Standards say about independence and objectivity. These reside in both the chief audit executive’s (CAE’s) access to senior management and the board, and in internal audit’s unbiased attitude. Above all, ‘Objectivity requires that internal auditors do not subordinate their judgment on audit matters to others’ and ‘the internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results.’
This means that if internal audit directly helps the first and second lines during this crisis, it should ensure that this activity does not influence any future engagements. Internal audit staff can do this through being mindful of how work they may do alongside first-line staff could give rise to future conflicts of interest. If this happens, awareness and full disclosure are the solutions.
If the CAE is ‘asked to take on additional roles and responsibilities outside of internal auditing, such as responsibility for compliance or risk management activities’, sensible safeguards must be established. These include reviewing reporting lines and finding ways of obtaining additional assurance if appropriate. As internal auditors, you know which controls you would look for when reviewing potential conflicts of interest, or other factors that could impair judgement and objectivity.
Yet there are significant advantages to the situation. First, internal audit has long sought to position itself as a collaborative, constructive element in the organisation. This is the perfect opportunity to demonstrate that. Many CAEs have already given examples of the most practical kind of help – catering and cleaning, for instance. The Institute’s own Liz Sandwith, for example, helped put sandbags in place several years ago, when the organisation where she was CAE faced flooding!
However, much of what internal audit can provide will be not too dissimilar from consultancy engagements – simply in real time. If your assurance engagements have concluded that your organisation’s risk and control framework is sound, this is a real-life test of which controls work under pressure, which need improvement and which can be temporarily suspended.
Some CAEs and their teams are sitting alongside senior managers and helping them design or revise processes as the crisis evolves. Updated emergency procedures and additional risk assessments are necessary right now, as is greater vigilance about fraud.
These examples slot neatly into much of what an internal audit function does anyway - assessing the organisation’s risks and controls. The main difference is that this is not a test, and yet it’s the truest test of how sound the controls really are.
So, what do you think you are expected to do – either as CAE, or as an entire team? What would be most useful to do? The two may not be the same. Use your judgement and expert knowledge of the organisation and sector to decide where your resources will help most.
There are many other practical ways in which internal auditors, especially those with specialist skills, can help the first line:
For many internal auditors, this is a chance to enhance relationships with the first and second lines. It will increase understanding of how they operate, especially under pressure, without hindering judgement in future engagements.
However, for other teams, the help and support internal audit provides cannot extend to working alongside the first line. Perhaps this is because of internal conflicts, or a lack of trust that would make internal audit vulnerable to accusations of interference. If you assess that it will not help the organisation or your relationship with the first and second lines, then it would be wise to find other ways to provide additional support.
Whatever you do to help your organisation through this crisis, make sure you let the audit committee know how internal audit is contributing. There will be more guidance soon on how and what you communicate to the audit committee during this time. In the meantime, though, do what you think serves the organisation best. That’s what internal audit is there for.