5 Ways COVID Has Changed Internal Audit Forever

The COVID-19 pandemic has played a momentous role in altering how audit, risk, and compliance professionals have undertaken their responsibilities. Over eighteen months later, this has resulted in fundamental changes in our day-to-day processes — from the basic way we communicate with our teams and other departments to the way we undertake our day-to-day responsibilities as audit, risk and compliance professionals. Only the passage of time will reveal if these changes will have been temporary or enduring. A number of outstanding articles have been written in recent months speculating on the long-term effects of the pandemic on internal audit. At AuditBoard, we wanted to know what chief audit executives think the long-term impacts of COVID will be on their operations and the profession at large, so we recently undertook a survey to gauge the likelihood of ten different pandemic-related scenarios that could permanently alter the profession. 

Most survey respondents believe it is likely the pandemic has transformed the profession in the long-run, and that several key trends are here to stay. Specifically, survey respondents told us they believe the most likely long-term impacts on the profession will involve: the use of technology to conduct audits, employing innovative means of gathering and analyzing evidence, greater reliance on technology for basic communication, a continuous approach to assessing risks, and the hybrid workplace model. 

Download 5 Ways COVID Has Changed Internal Audit Forever PDF

1. The use of technology will be more critical to conducting internal audits in the future. (91% agreed – 61% strongly)

For a profession that has traditionally relied on face-to-face meetings and access to physical evidence, mandatory lockdowns necessitated the greater use of technology to continue working. Thanks to the sophistication of existing technologies at the time quarantines began, audit, risk, and compliance professionals overcame the remote setback by deploying and exhibiting a greater reliance on a collective array of these solutions to help employees continue achieving their day-to-day objectives from home. In particular, cloud-based platforms that were designed to not only facilitate remote collaboration, but also automate department processes — e.g. end-to-end project management — were successful in streamlining and facilitating the actions of multiple stakeholders to reach common, intersecting goals. 

For one company, automated workflow technology — with the ability for a manager of internal audit to assign a task to various team members — was just as effective as holding fifteen in-person meetings to assign and complete an overarching goal. With these success stories, it is unsurprising that CAEs now feel technology will play an even bigger role in the effectiveness of internal audit going forward

2. We will be more focused on innovative means to gather and analyze evidence as part of internal audit processes. (83% agreed – 34% strongly)

Evidence must always be sufficient, reliable, relevant, and useful in affording internal auditors a basis for conclusions. While the value of in-person interaction between internal auditors and clients, and the physical examination of documents and other evidence has long been considered the strongest basis for conclusions, the creative solutions that audit teams deployed in the process of working around lockdown limitations produced new efficiencies — as well as new methods — for evidence gathering. Overall, thinking in the context of limiting physical site visits helped audit teams reimagine the possibilities and focus on ways to make virtual site visits yield sufficient evidence for their audit conclusions. The pandemic gave rise to new partnerships between audit, risk and compliance teams who mutually strategized to rely on each other’s work in the face of constrained physical site visits. In one example, an audit team partnered with their compliance continuous monitoring team to take pictures and gather evidence for them. 

Among the innovative uses of technology that have proven effective in the past year has been the use of drones, reliance on pre-positioned security camera video feeds, and video documentation by smart phones and other devices. While the potential of these technologies by internal auditors has been recognized for years, physical limitations imposed by the pandemic accelerated their use. Chief audit executives have reported that the use of drones to document the physical existence of assets or control effectiveness has provided sufficient evidence more efficiently than even traditional means.  

3. Most face-to-face meetings will be replaced with virtual meetings using video streaming technology. (72% agreed – 26.3% strongly)

Perhaps no form of technology has experienced a greater increase in usage during the course of the pandemic than video teleconferencing platforms for meetings. According to recent research, the Zoom platform alone has seen a 2,900 percent increase in usage since the end of 2019. By all accounts, audit, risk, and compliance professionals have embraced video platforms not only for meetings between members of the internal audit staff, but also for meetings and other face-to-face interaction throughout the audit process and communications with key stakeholders. In fact, many in the profession, myself included, have experienced a complete reversal of our traditional modes of communication — with regards to the typical ratio of video conference calls to in-person meetings. Though most organizations have reopened their offices to employees, most at limited capacity, the future of the business world embracing hybrid work models appears to be here to stay. Based on the survey responses, CAEs believe their teams will likely continue to rely heavily on technology-facilitated meetings as a more efficient means of communication.

4. We will focus more on emerging risks and their possible impacts on the company. (72% agreed – 25.7% strongly)

The pandemic has proven beyond doubt that the dynamic nature and velocity of risks must be an overarching consideration for internal auditors and other risk professionals. The fact that 72% of CAEs agreed with this statement, and over a quarter strongly agreed, speaks to the importance of auditing at the speed of risk. The COVID experience compels us to be more determined in the timeliness and precision with which we assess risks. To the extent that they were still in practice, periodic risk assessments are now obsolete. There must be a continuous component to assessing risks, not only in performing risk assessments with greater frequency, but in the methodologies and technologies we rely on to create to maintain a continuous perspective on risks. 

5. We will likely not return to our traditional workplaces, but will work remotely all or part of the time. (68% agreed – 35% strongly)

The COVID experience has demonstrated loud and clear that the internal audit workplace of the future does not need to be exclusively in a traditional office setting. People worked from home, vacation houses, and travel destinations — and were productive all the same. About three-quarters of employees want the option to continue to work remotely after the pandemic, according to a new Microsoft report. After the pandemic, businesses will be more flexible about where people are based when hiring. Based on the survey responses, it would appear that a strong majority of CAEs will embrace flexible workplace arrangements in the future. This may prove particularly true in markets where internal audit talent (especially expertise in specialized risks) is in short supply.

Disruption Fuels Innovative Change

Nothing is forever — but it’s unlikely that we’ll return to the way things were before the pandemic. If our experience throughout the pandemic has taught us anything, it may be foolhardy to assume that these changes will be permanent. Yet, one thing is certain: audit, risk, and compliance professionals across the board proved their ability to be agile, innovative, and productive in an environment where risk priorities can shift overnight. Organizations with internal audit functions that had already made investments in cloud-based technologies prior to the pandemic were not only ahead of the pack, but also more likely to have a seat at the “virtual table” with management as their organizations’ crisis management and resilience plans were enacted. For the past year, I have often repeated that “disruption accelerates innovation.” I have also long quoted Danish philosopher Soren Kierkegaard’s observation that “all change is preceded by crisis.” Taken together, I believe it is safe to say that crisis-induced disruption fuels innovative change. Our survey would indicate that CAEs agree.