Internal Controls over Financial Reporting (ICFR) and COVID-19

Many companies usually complete their risk assessment procedures in the first quarter of their fiscal year. These risk assessments drive both the internal audit and ICFR plans. Even though it is a best practice to leave some “unassigned” time in an audit plan for unanticipated events that occur, it is highly unlikely that companies would have considered COVID-19 to be as impactful as it has been, either positively or negatively.

Accordingly, companies may consider whether they need to reperform their risk assessment and change their plans, also accounting for the impact of the materiality considerations discussed above. We could see multiple revisions throughout the year depending on the economy.

New controls may need to be implemented and/or revised as companies start to modify IT access to enable remote workforces. New systems and platforms could be implemented to deal with the volume of remote workers. Controls will be increasingly relevant around the implementation of new systems and platforms, and the appropriate testing of moving programs from development into production.

Additionally, companies could see a spike in the number of calls from employees with remote IT issues; companies must ensure they have the resources to respond and the bandwidth to follow their ticketing and approval controls around changing roles/access, etc. Remote employees potentially working different hours may complicate the matter, depending on home situations, resulting in approvals taking longer to receive.

Potential reductions in force (RIF) and furloughs may occur and could require a significant amount of employee access to be removed or amended to certain systems. Companies should make certain that access change controls exist and function appropriately to effectively complete this potentially challenging control.

Another difficulty for companies with significant personnel changes is executing a “periodic review of access” control. This control is often considered an “umbrella” control, utilized by companies to mitigate other access control failures. Depending on the amount of changes, companies may need to increase the review’s precision and frequency.

Finally, companies will need to consider how “physical” or “in-person” controls like inventory observations can be performed via technology platforms like FaceTime, Zoom or Skype.

While controls around identifying and recording subsequent events are not new, additional thought should be given considering the velocity of changes in the business world during the first quarter of 2020. Typically, given the short time frame to file for accelerated filers, subsequent events requiring adjustments to the financial statements (Type 1 - recognized) are rare; this trend may be subject to change depending on rate of economic decline. Consequently, companies may need to conduct more detailed and precise review controls.

Additionally, controls around Type 2 (nonrecognized) subsequent events will also need to be at a greater precision in order to determine if items requiring disclosure are identified timely.

Companies reducing their workforce, potentially for the first time, may need to create controls in this area.

Additionally, with the inevitable request from management to operate with limited resources, companies may need to address the impact on segregation of duties.

Entity-level controls are also likely to be impacted by COVID-19. While certain policies and procedures around the communication and enforcement of integrity and ethical values are unlikely to be impacted, policies (and controls) around communication and assignment of authority and responsibility may be more impacted given the higher number of remote workers.

As mentioned above, controls over the segregation of duties are likely to be impacted. Therefore, companies should pay attention to this area, particularly to the precision of any access review controls.

Companies should also consider the effectiveness of other monitoring controls, including the ability to monitor the results of operations and even the effectiveness of a “remote” audit committee and other self-assessment programs.

With the risk of customers delaying or defaulting on outstanding invoice payments, the allowance for doubtful accounts models may need to be revisited and controls revised.

Additionally, as new revenue streams are identified, credit checks over new customers and surrounding controls will be increasingly important.

For some companies, controls around the physical receipt of cash may be impacted by a remote workforce. Companies may be required to establish electronic processes to receive and record the cash flow. Controls over access to bank accounts and segregation of duties could be impacted as well.

From a revenue perspective, companies should consider how COVID-19 impacts changes to their revenue models and subsequent controls. For example, many brick-and-mortar stores are vastly increasing their online sales channels, as in-store revenue has plummeted. Companies may need to consider revising controls around data security, accuracy and confidentiality.

Controls around the net realizable value and capitalization of variances may need to be revisited, as inventory pull-through is impacted by the economy.

Additionally, companies may need to reassess controls over the existence of inventory due to remote workplace issues.

Controls over vendor set-up, monitoring and reassessment may need to be revisited as vendors experience their own liquidity challenges.

Companies that still receive paper invoices will need to consider how to operate remotely and whether they should transition to a shared-service organization or technology platform. However, there are control implications around modifying the process.

Companies may also start to “manage” their payables by stretching payment remittances to customers. Controls around these changes in processes and practices may need to be revisited as well.

From an expense perspective, companies may also start limiting expenses and/or lower approval limits for cash expenditures, as well cancelling training events/conferences, etc. All of these activities should have some controls around the approvals, which may require documentation and testing.

Additionally, there are likely to be loss contingencies and exposures that may not have previously existed. Companies will likely need controls around identifying and recording these items.