Article written by:
Mike Purcell, CPA
Senior Manager, Assurance & Business Advisory Services
March 2020 will be remembered as the month that drastically changed our businesses, our global economy, and every aspect of our daily lives. Many businesses pivoted to home offices, staggered schedules, and adopted new rules and regulations in an effort to keep employees and customers safe. As business leaders, over the past three months, you’ve been inundated with information about PPP, EIDL, the CARES Act, COVID-19 and a host of other new acronyms and phrases. Two phrases that are worthy of your attention as economies begin to reopen, however, are “new normal” and “WFH” (working from home). Many businesses are evaluating new work arrangements, on a temporary and permanent basis, where employees will be away from their physical offices and working remotely. These changes introduce new risks to your company’s internal control structure and risk assessment and should be carefully evaluated.
The importance of a company’s information technology capabilities and control framework in the remote environment has received press from many leading industry experts, including GBQ’s Director of IT Services Doug Davidson. Significant resources and guidance have also been published regarding a company’s culture and the effects on employees as they balance new professional and personal responsibilities from home, including thoughts shared by our Managing Director Darci Congrove. However, as month three of operating in remote environments wraps up, organizations should be evaluating the changes in its work environment and the impacts on its internal controls, including those directly affecting financial reporting, as well as identifying new risks to the company as a result of remote employees.
Many employees have taken on new responsibilities in the past three months that may not typically fit their job description. Most of these changes have been out of necessity, but as we emerge from “survival mode,” how do these shifts in responsibilities or process owners impact your internal controls? While not intended to be an exhaustive list, how has the new environment affected the following processes and internal controls in your organization?
- Disbursement controls, including access to check stock, availability of authorized check signers, and ability to provide approval and documentation support. There’s no shortage of stories about bad actors that comprise an email system and appear to be an approved check signer, who is generally out of the office and requests that a payment be made via email. How does the remote environment introduce new risks to the review and approval process?
- Payroll review controls, including supervisory review of employees’ time. Consider remote environments, when supervisors are no longer working next to their teams.
- Segregation of duties pertaining to cash handling and receipt internal controls. Does your remote environment still permit, and require, adherence to previous segregation of duties controls?
- Custody and review controls for physical inventory and equipment. Do cycle counts and physical inventory controls still occur given a remote or reduced in-person work staff?
- How does the new environment affect your management judgments and estimates, including reviewing and revising assumptions which may have grown static during normal operating levels? Are there new risks to account for in reserves, impairments, or accruals?
- Are there changes to review controls, including evidence of review completion? Be wary of trend analysis and year-over-year fluctuations defaulting to “COVID-19” as explanatory for changes. Are there other underlying causal relationships which are being covered by the blanket of uncertainty and significant change?
As you contemplate the changes to your business, don’t forget to consider what you can move away from, or change, that was previously thought to be institutional. Here at GBQ, we’ve learned some of our internal processes that have been defended vigorously really weren’t as critical and will fall off as things we’ll never do again. There are no shortages of quotes about crisis breeding innovation and opportunity, and we have seen firsthand that there are opportunities for new efficiencies as we are forced to think through a “new normal.”
As you evaluate your processes and controls, we appreciate the opportunity to partner with you and your leadership team to identify new gaps in processes, risks to the organization, and control updates to keep your business, your employees and your customers safe.
