Kral Ussery's "Is COVID-19 Infecting Your Internal Control over Financial Reporting?" raises numerous likely challenges to maintaining effective ICFR in the current COVID-19 environment that companies should carefully consider and proactively address as respects their specific circumstances.
Key takeaways include:
- Most companies will have had to implement temporary workarounds to their ICFR processes and procedures due to remote working arrangements. Management should discuss and document such workarounds with their teams. Consider, for example: (i) How are review procedures surrounding paper documents being handled?, (ii) Are the review procedures adequate in light of potential distractions?, (iii) How do employees charged with reviews and approvals document reviews?, and (iv) If personnel is unavailable to perform a procedure due to illness or other reason, how is this communicated and addressed?
- Stressful work-at-home situations such as school age children may create pressures on employees to take shortcuts or forego certain controls entirely.
- Illnesses at home - which may be undetectable in a 100% remote work environment - could make staff members unavailable to perform key processes or procedures timely. Ordinary course checklists and like tools that are used in the ordinary course should be maintained or adapted to the current environment to monitor adherence to these controls.
- Managers may need to be more flexible with staff work hours based on specific work-at-home circumstances to increase the likelihood that ICFR won't be compromised as a result.
- IT staff should consider the likely relative insecurity and vulnerabilities of home networks/home internet environments, implement (virtual) training, and provide staff with resources to mitigate identified risks.
- Increased pressures on financial reporting results due to the impacts of COVID-19 may tempt shortcuts or less disciplined judgments, warranting strict compliance with ICFR policies and procedures.
- Significantly changed business conditions and associated implications such as changes in supply/demand and personnel/staffing, budget cuts, etc., may render certain fraud risk controls (e.g., segregation of duties) obsolete or ineffective.
See also the firm's "The New Landscape of IT Internal Controls" and our prior reports: "COVID-19 Q1 Reporting: What to do Now?", "Auditor's Review of Interim Financials: COVID-19 Considerations," "Address These Pandemic-Triggered Information Security Practices" and this report: "Audit Committee Oversight: COVID-19 Substantive & Process Considerations." This post first appeared in the weekly Society Alert!