Internal control environment after COVID-19

As business gradually returns to normal, companies large and small have begun to deal with a host of financial and operational issues that have been adversely impacted during the Circuit Breaker. Importantly, senior management should evaluate the operating effectiveness of the internal control environment by assessing the risk level and materiality of the actual disruptions to the company’s operations during Circuit Breaker. Depending on the size of the company and its internal control system, senior management should also assess any potential deficiencies in internal controls and the ability of individuals to perform control duties while under remote-work protocols.

Based on this assessment, senior management should determine whether existing controls are sufficient to cope with and operate at the reasonable assurance level. If a legacy control cannot be performed as previously designed, senior management should determine what new controls may be necessary to reduce the risk of errors and fraud. In doing so, senior management should ensure that any changes in design address both risks encountered as well as any potential new risks identified, due to adjustments in business and operations, namely remote work.

Below are some examples for senior management to consider:

• Classification of employees with regard to their respective activities in the internal control system;
• Clarification of whether the control activities can be carried out remotely by the employees in case of quarantine by using IT;
• Determination and integration of responsibilities with regard to these control activities in the corporate crisis management team; and
• Evaluation of business continuity plans with regard to the defined or yet to be defined substitution and emergency plans.

One might think it is possible to work with a reduced internal control system for some time during the Circuit Breaker. However, one should not underestimate the consequences this can have for the company. Most operational errors can cause financial damage to the company. Analysis should be carried out whether there were transactions or operations that may have exploited control gaps. The original controls must be fully tested again to ensure reasonable assurance of the internal control environment operates as designed.

At the same time, senior management should explore whether the internal control system can be modified and further optimized to adapt to the changes in control environment based on the experience gained during Circuit Breaker.

At the end of the internal control assessment exercise, senior management may uncover control activities that would add new efficiencies and effectiveness to the overall control environment.