The year 2020 will go down in the history books as one of the most trying years in modern world history. The COVID-19 pandemic has tested nearly every nation, government, business and individual in many unforeseen ways that heavily impact daily life, with additional consequences and impacts likely into the future. This blog post will provide a perspective that includes research along with a personal interview regarding how COVID-19 has impacted the ability of IT audit functions to execute and successfully deliver on their business outcomes and objectives.
A June article by Christopher Arnold, head of SME, SMP and Research for the International Federation of Accountants (IFAC), describes several potentially negative impacts to audit functions, such as the inability for auditors to perform routine physical inspections or observations they are accustomed to. Arnold went on to explain obtaining audit evidence in a traditional sense is now more challenging because physical counts of inventory, obtaining original documentation and having direct access to staff to conduct interviews can be more difficult than it was before the pandemic and the increased prevalence of remote work. This may result in auditors having to consider the impacts of these evidence-gathering impacts on the final audit report and offering a modified opinion that takes into account any tests affected by non-standard evidence collection procedures.
To compensate for the lack of physical availability to properly collect evidence, the auditor may consider alternatives to properly form an opinion on controls, including whether inventory inspection or documentation can be observed on an alternate date when attendance is not possible by year end, with audit procedures against intervening transactions performed. Leveraging technology that allows the client to remotely perform a physical inventory count via video feed or share documentation through Dropbox or other secure file-sharing technology might also be necessary.
The remainder of this blog post sheds further light on this topic via my recent Question & Answer session with Dawn Vogel, Director of IT Audit at Nelnet. Dawn began with the premise that audit engagements aren’t too different from prior to COVID, although certain challenges are exacerbated:
Q: How has the shift to work from home impacted the ability to plan audits, conduct audits or hold stakeholder meetings such as entrance conferences, as well as draft report reviews, final report issuance, etc.?
A: The shift has forced audit shops to become more mature in their adoption of agile audit techniques. The shift has required audit to focus on what is really necessary to meet the objectives of an audit (most viable product). Take a cycle audit for example. An email or phone call discussing the objectives of an audit and confirming any changes may suffice in lieu of a formal entrance conference. Documenting only the key points and using more informal communication saves time as it’s sometimes easier to complete tasks for both parties within a certain timeframe. The same holds true for issues and reports; there are efficient ways of communicating based on the desired outcome.
On the negative side, sometimes this flexibility gets to the point of delaying tasks to the last possible minute, so it’s important to have regular communication (e.g., stand-ups or routine ceremonies) in a way that people can digest. It’s becoming harder to obtain information if you are not working the way your customers work, so our department is moving toward a workflow-based system and away from email. It’s important to have clear direction on projects so that employees know what they can do to be productive during any periods of downtime.
Q: How has the shift to work from home impacted team morale or the quality of work the audit team is producing? Is energy from the audit team and engagement levels decreasing/increasing, etc.?
A: Given the length of the pandemic and the uncertainty of how long it will last, morale can be perceived at times to be lower generally. There are typically ebbs and flows to morale, but this is making the ebbs longer and deeper. Everyone has a different situation, so it’s also important to understand what the team or an individual’s needs are. It’s more difficult to read body language and tone over video conferencing, but it’s a new skill people need to learn. Now more than ever, it’s important to have non-work-related connection time, and it must be built into the workday. It can be helpful to send routine, but quick IM messages and schedule short one-on-one meetings to keep connections strong.
While the quality of work has not changed, it sometimes takes longer to get there. It’s easier for people to ignore information requests when you can’t walk to their desk. They can ignore phone calls, voicemails, IMs, emails, and meeting requests until they are ready to gather the information. Relationship-building and understanding objectives and impacts of requests are of utmost importance. An auditor is much more likely to be timely when we are working like the business area, so it is important for IT auditors to adopt agile methods and workflow applications.
Q: How has the shift to work from home impacted relationships with audit customers?
A: In some respects, the shift to work from home has provided a bonding experience between audit and its customers. We are all on the same playing field and we have had to work together to find creative solutions to issues that work for both parties. Everyone can more easily relate to technical difficulties these days! The same audit deadlines exist – however, audit teams often aren’t able to communicate immediately due to other priorities and possible technical issues. When you aren’t able to physically see a control operate as you did in the past, you have to work together to find ways to meet the objective. It has required audit to provide more information on why we are doing what we are doing along with the desired outcome, and that helps the customer more than asking for a particular document.
Editor’s note: For additional audit guidance and best practices, download the new 4thedition of ITAF from ISACA.
