Crisis Resilience
Analysis
Auditor Independence In Times of Crisis
June 19, 2020
Tags: independence, internal audit
As organizations grapple with the impact of COVID-19, everyone is expected to play their part. Many chief audit executives (CAEs[1]) and their teams are being asked to offer more “hands on” help to support management. When the boat is sinking, everyone from captain to galley crew is expected to be on bail-out duty. However, is it possible for internal audit to remain independent while undertaking these new tasks?
[1] i.e., the head of internal audit
Highlights
- COVID-19 impacts on internal audit’s roles and responsibilities: the pandemic has pressed some internal auditors into roles outside the comfort zone.
- With the right mindset, safeguards, and oversight by the board or audit committee, there is no trade-off for internal auditors between being independent and being valuable in times of crisis.
Pressure on internal audit independence
More significantly, in a crisis, should auditors and audit committees regard independence as secondary to providing maximum value? Is it really a matter of choosing between helping management in any way possible or declining in the interests of maintaining independence?
COVID-19 has put pressure on internal auditors as they strive to support management as best they can. Internal audit’s unique position and expertise make it ideally suited to provide insightful advice to foster continuous improvement. Internal audit should be responsive to circumstances and flexible in order to provide maximum benefit. Offering advice, even developing solutions, does not amount to taking management decisions or ownership of risk.
Governance
In a crisis, the CAE should anticipate where senior management and the governing body would gain most from advisory services. Through such activity, internal auditors will be able to help the organization learn valuable lessons for the future. In other words, they should continue to think and act like auditors, even when undertaking advisory tasks.
| Key governance roles | Leader | Requirements |
| Accountability to stakeholders for organizational oversight | The governing body | Transparency, integrity, and leadership |
| Actions undertaken to achieve goals effectively, efficiently, ethically, and sustainably | Management, including any specialist risk functions | Resources and direction, and actions taken to manage risk |
| Objective assurance and advice on the adequacy and effectiveness of governance and risk management | Internal audit and any other closely related functions (such as oversight, evaluations, investigations, inspections, and remediation) Note: external audit provides further assurance on the accuracy of financial reporting | Independence from the responsibilities and decisions of management, and accountability to the governing body |
For example, auditors can help senior management develop appropriate mitigation strategies to ensure business objectives will continue to be met. They can identify and prioritize emerging risks related to the pandemic that threaten the organization’s top strategies. Key risks to be assessed during this pandemic include impact to programs, goods and services provided by public organizations; revenues; employee health and safety; supply chain; and cybersecurity. Updating the risk assessment is particularly useful as this process can highlight the impact of similar risks if the pandemic dissipates before a second wave occurs.
Internal audit independence and objectivity
At the same time, taking on advisory roles should not jeopardize routine assurance work.
| Requirements for independence of the internal audit function | Requirements for internal audit objectivity |
| Accountability to the governing body (directly or via an independent audit committee). Unfettered access to the people, data, and resources needed to complete its work unimpeded. Freedom from interference. | Adherence to professional standards. The application of disciplined and systematic procedures. An unyielding commitment to a code of ethics. Possession of a specific set of competencies. |
Internal audit must continue to follow a risk-based approach to its audit planning and implementation. As the risk landscape changes, the audit plan needs to change, but the approach does not. Ensuring relevance requires alignment with organizational needs and priorities and depends on continuous stakeholder engagement, including close liaison with external auditors.
Stepping outside the comfort zone
While advisory services are clearly within any modern internal audit function’s scope of work, the pandemic has pressed some practitioners into roles outside the comfort zone.
Some internal audit functions have taken on new roles outside of their traditional scope, even if this creates a threat to independence of the function and objectivity of internal auditors. For example, because of their risk and control knowledge, some internal auditors have moved temporarily into first and second line roles. Other internal audit departments are analyzing the processes that are most affected by COVID-19 and identifying the necessary changes in the key controls to minimize the risk to financial reporting, transaction processing, technology operations, and, last but not least, compliance.
A recent survey conducted by the European Consortium of Institutes of Internal Audit (ECIIA) Public Sector Committee confirms adjustments being made to audit plans as well as the expanding role of internal audit due to COVID-19. Nearly 52% of survey respondents cancelled engagements because of COVID-19, 21% added new engagements, and a similar percentage reduced scope for some engagements (see Exhibit 1). Only 20% redirected staff to do non-audit work (see Exhibit 2).
Note: Q5. How has your audit plan changed as a result of COVID-19?. Q2: Did you transfer staff to non-audit work? Survey responses collected May 13, 2020, from “The Impact of COVID-19 for internal auditors in the Public Sector- Webinar report” (n. 183 participants working mainly into the EU public sector). Source: ECIIA Public Sector Committee (https://www.eciia.eu/2020/04/webinar-the-impact-of-covid-19-for-internal-auditors-in-the-public-sector/).
No trade-off on independence
Independence of an internal audit function is not directly valuable for its own sake but as a means of enabling the objectivity, authority, and credibility of its internal auditors and their work. It is always important to apply appropriate safeguards when organizational independence or auditor objectivity are under threat due to close association and involvement. Auditors can maintain their objective mindset through application of professional standards and refraining from assuming managerial responsibilities. In all such cases, the CAE should ensure the governing body is fully informed of and approves any additional tasks being undertaken in response to management requests. If these measures are insufficient to reduce the threat to independence of the function and objectivity of individual auditors to an acceptable level, then the CAE should recommend using a qualified third party to provide assurance over the activity in question.
Accordingly, CAEs should feel confident to respond to the pressing needs of management as long as reasonable safeguards are taken. Senior management and governing bodies should be encouraged to utilize internal audit services this way. Internal audit is essential to organizational success, now more than ever.
Is there a necessary trade-off for internal auditors between being independent and being valuable, especially in time of crisis? The answer is an emphatic no. With the right mindset, safeguards, and oversight by the board or audit committee, internal audit is positioned to provide its unique value of well-informed, independent, and objective insight, assurance, and advice.
| About the experts Massimo Proietti , CIA, CCSA Massimo Proietti is the Chief Audit Executive/Anti-Corruption and Transparency Officer and the Supervisory Board Member at the “Poligrafico e Zecca dello Stato” Spa (State Mint and Government Printing Office), with more than 15 years’ experience in internal audit, risk management, compliance, anti-corruption, and transparency. He holds an MA in Economics from La Sapienza University, Italy, the CIA (Certified Internal Auditor) Certification/Institute of Internal Auditors, and the Certification in Control Self-Assessment (CCSA)/Institute of Internal Auditors. Mr. Proietti is a member of the Italian Association of Internal Auditors (AIIA), the Institute of Internal Auditors (IIA), as well as the AIIA Public Sector Committee coordinator and the ECIIA Public Sector Committee member (ECIIA – European Confederation of Institutes of Internal Auditing). He is also a founder of the “Italian Anti-Corruption and Transparency Association” (AITRA). He began his career in 1999 with “Birra Peroni” SpA (subsidiary of SABMiller plc group) as an internal auditor and later as a corporate governance manager. From 1999 to 2012 he worked for “Poste Italiane” Spa as an internal audit manager. He has been teaching at the Italian Association of Internal Auditors since 2006 (in particular the course: “Integrated evaluation methodology of the Internal Control System”). Francis Nicholson CIA, QIAL, CRMA Francis Nicolson is the Managing Director of Global Advocacy at The Institute of Internal Auditors (IIA) in Florida, USA. In this capacity he is responsible for promoting the value of the profession of internal auditing globally to stakeholders in an attempt to change thinking and provoke constructive actions that will foster an environment in which internal auditors can maximize the contribution they make to their organization’s success. He also works to support The IIA’s over 200,000 members and 110 global affiliates in being effective advocates on a local, national, and regional basis. Mr. Nicholson joined the Chartered Institute of Internal Auditors in London, an affiliate of the global body, in 2007 as the Director of Education. He has over 25 years’ experience in vocational and academic training, education, and professional development as an instructor, curriculum designer, faculty head, assistant principal, and consultant. He moved to Florida in 2013 and has held a number of roles for The IIA in training, certifications, and advocacy. From September 2018 Mr. Nicholson was the staff liaison to the working group of The IIA that led the review and update of the Three Lines of Defense, to be launched as the new Three Lines Model in July 2020. |
[1] i.e., the head of internal audit
Let’s Discuss
Crisis Resilience
-
Posts
-
- You must be logged in to reply to this topic.