The impact of recent global trends - April 2021 - ECIIA
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
ECIIA
The impact
of recent global
trends
ON INTERNAL AUDITING IN THE
INSURANCE INDUSTRY
April 20210
Introduction about ECIIA 05
1
Introduction 07
07 Use of Technology
07 Workforce
07 ESG, Sustainability
07 Topics covered by this paper
2
Impact of Macro Trends 09
3
Reaffirming the purpose 13
4
Impact of the new ways of 16
09 Impact on the global environment and on Insurance Companies of Internal Audit working
10 Reactions of Insurance Companies
13 Judgement at the core of audit assurance 16 Medium-term Impact on the Working Environment
10 Immediate reactions of Audit Departments to the crisis
16 Opportunities of a Remote Working Environment
16 Risks of an entire shift to Remote Working
18 Impacts of Remote Working on Companies
20 Impact on the Internal Control System
5
Remote Auditing 22
6
Future of Audit Work 27
7
Conclusions 31
22 Opportunities of Remote Working for Internal Audit 27 Beyond the immediate, frameworks should not fundamentally change
23 Audit needs 27 Building on the right mix of physical and remote working
23 The limits of remote working for auditorsABOUT ECIIA
The European Confederation of In-
stitutes of Internal Auditing (ECIIA) is
the professional representative body
of 34 national institutes of internal
audit in the wider geographic area of
Europe and the Mediterranean basin.
The mission of ECIIA is to be the con-
solidated voice for the profession of
0
internal auditing in Europe by dealing
with the European Union, its Parlia-
ment and Commission and any other
appropriate institutions of influence.
The primary objective is to further the
development of corporate governance
and internal audit through knowledge
sharing, key relationships and regula-
tory environment oversight.
ABOUT ECIIA INSURANCE COMMITTEE
ECIIA set up an Insurance Commit-
tee1 in 2012 with Chief Audit Execu-
tives of the largest European Insur-
ance companies. The mission of the
ECIIA Insurance Committee is: “To be
the consolidated voice for the profes-
sion of Internal Audit in the Insurance
sector in Europe by dealing with the
Regulators and any other appropriate
institutions of influence at European
level and to represent and develop
the Internal Audit profession as part
of good corporate governance across
the Insurance Sector in Europe ». ECI-
IA represents around 47.000 internal
Introduction auditors and around 12.000 are ac-
tive in the insurance sector. The paper
about ECIIA
describes the results of discussions
amongst the Committee members and
we want to thank the Committee mem-
bers for their input and James Fisher,
Global Head of Audit Practice at AXA
1 Stephen Licence (Legal & General) and Committee Chair,
Amaury De Warenghien (Axa), Nora Guertler (Generali), and Antonella Loffredo, Audit Manag-
Ann-Marie Andtback Beckman (Sampo Group), Martin er at Assicurazioni Generali for their
Studer (Zurich), María Luisa Gordillo Gutierrez (MAPFRE),
Andréa Joham (Uniqa Group), Dr Jeannine Bartmann (Alli- collaboration.
anz Group), Astrid Langeveld-Vos (Achmea).
5The Covid-19 pandemic has been the ning of being understood. A new com-
most significant disruptive event for prehension is emerging for what di-
decades, impacting the political, social versity and inclusion can really mean,
and economic environment of insur- and what the opportunities of a truly
ance companies for years to come. It diverse and inclusive workforce can
has been a catalyst for several dis- bring both to the business and individ-
tinct pre-existing macro trends which uals. Beyond equality of opportunity,
are described in the following. appreciation is growing for the bene-
fits of having varied frames of refer-
ence and different points of view.
1
USE OF TECHNOLOGY
Disruption to business also stems ESG, SUSTAINABILITY
from technological advances which
enable location-independent working. Concern is increasing on global en-
The Covid-19 pandemic has acceler- vironmental and societal conditions,
ated almost universally the adoption with the role industries play and are
of technological solutions as coping expected to play in actively contribut-
mechanisms for lockdowns and travel ing gaining attention.
restrictions.
Advances in data analytics and the
consequent impact on auditing (as TOPICS COVERED BY THIS PAPER
well as on insurance business) are not
This paper addresses the following
covered in detail in this paper, since
topics:
they are covered in the forthcoming
ECIIA Guidance Paper on unlocking Impact of macro trends: on insurance
the value of Internal Audit functions and Internal Audit, focusing on those
by implementing Data Analytics / Sci- directly resulting from the Covid-19
ence. pandemic1;
Reaffirming the Purpose of Internal
Audit: Judgement at the Core of Audit
WORKFORCE
Assurance;
With a significant part of employees in
Impact of the New Ways of Working:
remote working from one day to the
Environment and risks;
other and for at least one year, the
Introduction Covid-19 pandemic has triggered a
revolution in the daily life of white-col-
Remote Auditing: Opportunities, Audit
needs and limits;
lar workers. Impacts on performance,
results, collaboration, teams, leader- Future of Audit Work in the light of pro-
ship, people development and man- cess automation and remote working.
agement, professional threats and
opportunities are just at the begin-
1 The specific considerations for Internal Audit resulting
from the workforce and climate macro trends are includ-
ed in a separate paper addressing ESG (Environment, So-
cial, Governance) matters.
7IMPACT ON THE GLOBAL ENVIRON- • Pressure on insurers from govern-
MENT AND ON INSURANCE COMPA- ments, regulators, the consumer pro-
NIES tection bodies and public to share the
consequential costs of the pandemic
The impact of the Covid-19 pandemic and to compensate customers above
on the global environment of insur- and beyond contractually agreed lim-
ance companies includes, inter alia, its.
the following measures and subse-
quent effects, in a context of a general • Calls by the ECB, EIOPA and most
increase in political instability2: European national supervisory au-
2
thorities for insurers to suspend or
• Lockdowns lasting several months defer dividend payments.
in many countries and returning in
waves, complete or partial closure The key impacts of the Covid-19 pan-
of borders, obstacles to shipping demic on the business and risks to in-
of goods and travel, shift to remote surance companies are as of today3:
working for a significant part of the
population. • Increase in financial risk (incl. im-
pairments of assets) due to market
• Impacts on urban structures with volatility and low interest rates.
cities starting to change, affecting
also Real Estate. • Increase in liquidity risks as well as
credit risks.
• Drop in GDP in most countries as a
result of contraction in many indus- • Increase in operational risks: IT
tries (e.g. aviation, tourism, manufac- and security risks (e.g. functionality
turing) and increase in insolvencies, of IT and corporate processes during
with the risk of recession, increase in lockdown; cyberrisks due to a combi-
credit defaults and another financial nation of an increased external threat
crisis. potential and employees working from
home) and Fraud risks.
• Massive financial aid package by the
EU and measures taken by the ECB to
• Significant increase in financial
stabilize the economy, and other eco-
losses and underwriting risks for
nomic policies introduced outside the
corporate business, depending on the
EU; subsequent expansion and exten-
portfolio and the underlying terms
sion of the low interest rate environ-
and conditions (massive increase in
ment across the globe.
claims for business interruption and
Impact of • Increased volatility on global equity
markets: dramatic falls on equity mar-
event cancellation).
macro trends
• Increase in legal risks and compli-
kets in March/April 2020 followed by
ance risks (e.g. requests to insurers
a period of recovery and potential re-
to share in the consequential costs
peats of the cycle as further waves or
of the pandemic; legal rulings in the
the economic impact of the pandemic
event of unclear or disputed terms in
materialize.
insurance policies).
2 For more details refer to the Joint Committee report on
risks and vulnerabilities in the EU financial system (EIOPA, 3 These and further risks are published for example by
ESMA, EBA) EIOPA in its Risk Dashboard..
9• Increased understanding of the op- Regulators have contributed to the cusing on outcomes (quality and pro-
portunities and benefits of a globally debate on how to help citizens to deal ductivity) rather than time spend, and
connected workforce and reduced with Covid-19 impacts. EIOPA for in- heightened focus on communication,
need for corporate real estate. stance, in a statement on actions, team management and support.
launched a call to action for insurers
and intermediaries to mitigate the im-
pact of Covid-19 on consumers.
REACTIONS OF INSURANCE COMPA-
NIES
IMMEDIATE REACTIONS OF AUDIT
Most insurance companies have tak- DEPARTMENTS TO THE CRISIS
en the following measures to face the
crisis: In view of the crisis and the shift to
remote work, many Internal Audit de-
partments have taken one or more of
• Activation of Business Continuity the following ad hoc measures in re-
Plans; sponse to the Spring 2020 lockdowns:
• Shift of large parts of their staff to • Updating the audit risk assessment
remote work;
• Reviewing audit planning and ad-
• Significant enhancement of IT in- justment of plan timeframes
frastructure, network capacities and
digital tools; • Presentation to and approval of the
Audit Committee of envisaged chang-
• Finance: Liquidity and cash man- es of the audit risk assessment, the
agement, updates of business plans; audit plan and potentially of audit op-
erations
• Underwriting: Review of contract
conditions, removal of silent covers • Extension of the planned implemen-
(e.g. pandemics, cyber); tation dates of all or some outstand-
ing corrective actions
• Product: Innovation and/or revamp
of insurance products in order to • Flexibility with the deadlines estab-
meet clients’ needs and protect the lished for answering draft reports
company from accumulation of risks; and providing action plans
• Managing the impact on business • Providing temporary support to oth-
and operations in various ways (cus- er business areas during the acute
tomer services, claims management, phase of the crisis
impact on underwriting, etc.);
Moreover, Internal Audit has experi-
• Steps towards digitalization of dis- enced the same adoption of remote
tribution activities, claims manage- working as other departments, with a
ment and other client interactions variety of consequences, for instance
points. a resultant further shift towards fo-
10JUDGEMENT AT THE CORE OF AUDIT Moreover, the International Stan-
ASSURANCE dards for the Professional Practice
of Internal Auditing, define the assur-
The Institute of Internal Auditors (IIA) ance provided by Internal Audit as fol-
sets the purpose of internal auditing lows: “Assurance services involve the
as: an independent, objective assur- internal auditor’s objective assess-
ance and consulting activity designed ment of evidence to provide opinions
to add value and improve an organi- or conclusions regarding an entity,
sation’s operations. It helps an or- operation, function, process, system,
ganization accomplish its objectives or other subject matters. The nature
3
by bringing a systematic, disciplined and scope of an assurance engage-
approach to evaluate and improve ment are determined by the internal
the effectiveness of risk management, auditor”. Further insight and require-
control, and governance processes4. ments on Audit work can be found in
the ECIIA Guidance Paper on Internal
The IIA has further defined the core
Audit5.
principles that Internal Audit should
exhibit to be effective in achieving this In the pandemic context of significant
purpose: change and accelerating trends, any
impact of the situation on Internal Au-
• Demonstrates integrity
dit’s purpose needs to be considered.
• Demonstrates competence and due
Both the purpose and principles
professional care
hold true and already include for-
• Is objective and free from undue in- ward-looking focus on improving
fluence (independent) the company’s management of risks,
whatever these risks may be and their
• Aligns with the strategies, objectives rate of change. In the pandemic sit-
and risks of the organization uation caused by Covid-19, there is
even more need for Internal Audit to
• Is appropriately positioned and ad- provide assurance, to be insightful,
equately resourced proactive and future focused, and to
promote organizational improvement.
• Demonstrates quality and continu- Generally, the core principles have
ous improvement historically been managed “on site” in-
volving a degree of physical proximity
• Communicates effectively
with management. Therefore, the spe-
cific impacts of the shifts in company
Reaffirming
• Provides risk-based assurance
operations and the way auditors work
• Is insightful, proactive and fu- resulting from the pandemic, which
the Purpose of ture-focused limit this contact, further strengthen
the need for effective communication,
• Promotes organizational improve- and the principle of aligning with strat-
Internal Audit ment egy, objectives and risks is particular-
ly relevant. To be truly future focused
4 https://na.theiia.org/standards-guidance/mandato- 5 https://www.eciia.eu/wp-content/uploads/2019/06/
ry-guidance/Pages/Definition-of-Internal-Auditing.aspx ECIIA-Display-8th-draft.pdf
13requires strong relationships with
management to have a continuous di-
alogue, i.e. not limited to individual as-
signments, planning discussions and
committees.
The assurance which Internal Audit
provides as the core of their services
requires an objective assessment of
evidence. In order to align to the com-
4
pany’s priorities and risks, and to pro-
vide useful, sound assurance, Profes-
sional judgement, based on relevant
information, remains a key require-
ment for internal auditors. Although
professional judgement can be built
on a variety of inputs and sources,
the availability and accessibility of
relevant information may be affected
by the change companies are going
through in response to the pandemic
situation. The Covid pandemic mere-
ly serves to reinforce the importance
for Internal Audit to be forward-look-
ing, and that requires regular interac-
tion and deep knowledge which can be
limited where staff work excessively
remotely. This is explored further in
the sections 5 and 6 on Remote Audit-
ing and the Future of Audit Work re-
spectively.
Impact of the
New Ways of
Working
14MEDIUM-TERM IMPACT ON THE and short-term assignments. Obvi- bracket the working day, the distinc- in a paperless environment. In most
WORKING ENVIRONMENT ously, the knowledge of the local situ- tion between work and home life can cases, employees do not have a sepa-
ation, regulation and language needs become blurred. Without encourag- rate office at home which can result in
In the lockdown phases of the pan- to be ensured. ing staff to switch off, overwork can the following unintended consequenc-
demic, remote working has become become as real a risk as managers es:
standard for white collar workers. As for the abovementioned short- not realizing that some staff may be
Some companies envisage operating term expense reductions for compa- underworked, but with a greater per- • Access by third parties – people not
wholly through remote work, seeing nies as a consequence of large-scale sonal toll. Inadequate home office en- working for the company can access
the benefits of global connections, remote working, these need to be bal- vironments can compound the effect, company records and information,
and using virtual conferencing tools anced against medium-term impacts particularly where staff had to make even unintentionally, and materials.
to compensate the loss of physical in- including the risks mentioned in the the emergency switch over in ear-
teraction. With increasing pressure section below. At the current stage, • Eavesdropping – with people work-
ly 2020. Adequate and healthy home
on revenues resulting from the strain this trade-off is difficult to assess, but ing from home, phone calls and video
working arrangements, such as pro-
placed on economies and populations will become clearer in the following conferences might be overheard by
viding monitors and chairs, can be
come new initiatives on reducing months and years. friends, family members, neighbours
managed for longer-term working
business travel, expenses and even and/or staff such as the cleaner.
from home arrangements. Howev-
company premises. It remains to be er, there will always be limits in some • Unsecure data storage – com-
seen to what extent the temporarily cases, such as not having a dedicated
RISKS OF AN ENTIRE SHIFT TO RE- pounded by the potential increase in
imposed switch from human contact room separate from other household
MOTE WORKING use of private storage devices in the
to a virtual environment will contin- activities. absence of proper office infrastruc-
ue once the political restrictions have TO STAFF: WELL-BEING, PHYSICAL AND MENTAL
ture. For instance, without scanners
been lifted. After having experienced HEALTH Clearly, new rules are needed and
provided by the company, confiden-
significant cost reductions during will require agreement with workers’
Staff that work entirely from home tial documents can be stored, pos-
lockdown phases, many companies unions. In the first instance, clarity is
can suffer from increased stress, de- sibly temporarily, on mobile phones
will not return to previous levels and needed on what is meant by “Smart
pending on personal circumstances. and uploaded to weakly-protected
instead point at sustainably lower ex- working”, what this package precisely
Where living alone, the loss of contact private cloud storage. Where private
penses. The temptation to cut trav- includes and how this is distinguished
and particularly informal interactions, cloud services are used, particularly
el significantly needs to be tempered from the merely logistical questions of
can result in isolation and disconnec- to transfer data, the location of these
with a discretionary need to travel and “remote working”.
tion, real or perceived. Moreover, data is not always managed, and pri-
meet in person. Nonetheless, a degree
during the most severe forms of lock- TO ORGANISATIONS: CONFIDENTIALITY AND SE- vacy regulations may not be respect-
of remote working is here to stay.
down such as those seen in Spring CURITY ed. Securing data storage is a mat-
2020, schools and childcare centres ter of IT management and not strictly
Without the physical security of the linked to remote working; neverthe-
were shut resulting in staff juggling
OPPORTUNITIES OF A REMOTE office, confidentiality can be more of less, the abrupt switch from company
work with teaching or looking after
WORKING ENVIRONMENT a problem, for example when video premises to private locations has ex-
children. Although such an extreme
or phone calls take place either from acerbated this peril.
situation is unlikely to become perma-
The opportunities of a largely remote home or from public places. More-
nent, a workforce which is substan-
workforce include that geographical over, company information is likely to • Insufficiently protected networks
tially working from home exacerbates
resourcing becomes less important. be generated and managed outside – private routers generally provide
the need for flexibility and for employ-
The skills of a global workforce can the office, which calls into question less secure connections than those
ers the need to understand the spe-
be more easily leveraged to optimize the boundaries of what constitutes managed by professional security
cific personal circumstances of each
resourcing, and indeed hiring, beyond the company, when storing, accessing staff. However, companies unused to
member of staff to prevent psychoso-
the confines of a particular location or managing hard documents occurs massive remote working or unwilling
cial risks.
(office, country or even continent). in a decentralized way. This concern to accept the cost may not have suf-
This can be beneficial for both long- Without the “convenient” commute to also applies, in a slightly different way, ficient technical capacity to support
16 17systematic use of secure connections have remained also in times of remote across the workforce is a challenge ing tools for upskilling, reskilling and
such as through Virtual Private Net- working, informal information flows as the sense of belonging may be im- continuous learning, will be better po-
works (VPN). “at the coffee machine” have been sig- pacted while companies adjust to the sitioned to retain their top talent and
nificantly reduced. Casually meeting new ways of working with less phys- create future-ready leaders. Howev-
• Potential tax, labour law and other many people at the same time in the of- ical contact. Even recognizing that a er, the benefits of digital learning need
regulatory risks – the virtual world fice, also spontaneously, seeing their company is more than just its walls, to be distinguished from on-the-job
blurs borders and what may consti- faces and deciding ad hoc whether to successfully onboarding joiners in learning, observing colleagues and
tute cross-border operations, sales talk to someone has disappeared in a a situation where they may not meet leaders, and the onboarding of new
and working may result in new dimen- remote world. Participation in infor- their teammates in person for poten- joiners as explored further below.
sions to various regulatory frame- mation flows happens on invitation, tially an extended period of time is dif- In general, companies need strong
works designed when market and en- increasing the siloes between differ- ficult. The consequences on individual training plans in a remote world, in
tity borders were more enforced. ent areas of the company and even development need to be considered, order to consciously compensate the
people in different departments. The particularly for junior staff acquiring above-mentioned effects.
• Control of employees in critical ar-
“3-minute elevator chat” has become professional experience. Less cohe-
eas – there are first observations that
rare. Those in the company who are sion and a weakened company culture IMPACT ON PRODUCTIVITY
extensive remote working can pres-
already strong and well connected will adversely affect a company’s sus-
ent a significant risk for companies in Some research highlights that remote
are becoming even stronger, others tainable development in many dimen-
areas where a defined level of control working does not result in a reduc-
risk being left behind. sions, e.g. as a consequence of less
is key, for instance regarding market tion in productivity. Companies that
impactful informal information flows,
abuse in fund management activities6. Only time will show the impacts of were already collaborating effectively
staff less willing to go the extra mile
these developments on the quality of and working productively before the
and difficulties to retain talent.
decision making, when even leaders pandemic have remained productive
might have a less complete view on The already existing trend towards so- during lockdowns and other disrup-
Furthermore, the threat from criminal
the overall situation when taking their cial media driven digital interactions tions. Stay-at-home orders freed-up
agents has increased during the pan-
decisions. puts companies in an environment time previously spent commuting and
demic as certain groups try to take
of faster changing teams when peo- created flexibility in work schedules,
advantage of the slackened security
COMPANY CULTURE AND COHESION OF TEAMS ple group together according to their enabling many employees to devote
enjoyed by employees, with an uptick
current topics of interests. In com- additional time to their jobs.
in e.g. phishing attacks and attempts As an impact of remote working, pro-
to install malware via cyber-attacks. bination with the impact on company
fessional interaction is becoming more On the other hand, a contributor to the
culture and the cohesion of “classical”
transaction-based, with a reduction in increase in productivity is the tenden-
teams described above, this may re-
the relational part. In the short term cy to overwork in a lockdown situa-
sult in the need to rethink corporate
IMPACTS OF REMOTE WORKING ON this has increased productivity in tion. In addition, productivity at home
organization in the medium and long
COMPANIES many areas, whereas in the medium depends on the precise conditions
term.
and long term, neglecting relation- there, which is outside the sphere of
INFORMATION FLOWS AND DECISION MAKING ships will take its toll. After almost LEARNING AND PROFESSIONAL DEVELOPMENT influence of an employer. Whilst some
one year of extensive remote working employees benefit from a fully-fledged
The shift to remote working has re- in place, many companies observe a The new ways of learning and de- home-office including a quiet and con-
inforced the already visible trend to drop in the engagement of their em- veloping professionally have moved centrated atmosphere, others will find
shift part of a company’s informa- ployees. The risk of a decrease in em- trainings from the classroom to vir- it difficult to concentrate when sitting
tion flows to virtual communities. In ployees’ identification with the compa- tual platforms. The Covid-19 outbreak at the kitchen table, with their partner
some cases it is not yet clear how and ny and of their motivation in a remote has emphasized the potential of dig- doing phone calls in another room and
whether they are managed and who or hybrid working environment needs ital learning due to the constraints the children requesting the attention
should participate. Whilst the classi- to be well understood and managed7. imposed on social distancing, travel they can rightfully expect.
cal information flows defined by the and events. Organisations investing
company’s hierarchical structures Creating and maintaining cohesion or planning to invest in digital learn-
6 Financial Times, February 15, 2021: “Homeworking 7 Il Sole 24 Ore: “Lo Smart Working sta riducendo la ca-
sparks red flag alerts over market abuse” pacità di creare innovazione”
18 19Moreover, the productivity levels ob- independently of where people are
served so far also benefit from per- working from. An assessment of their
sonal relations established in the functioning then consists in a “me-
past. Therefore, it should be observed ta-control” verifying that the entire
attentively how productivity develops system of controls is working well,
over time, when an increasing num- which on the one hand can be done re-
ber of people is working together al- motely, on the other hand it adds value
though they have never met in person. to talk to the people having designed
There is certainly a risk of a decline in and maintaining it - not only remotely,
productivity in the medium and long but also in person.
5
term, depending on the specific tasks,
the duration, and the conditions of
remote working.
An increased threat potential from
IMPACT ON CREATIVITY AND INNOVATION8 cyberattacks of all types, and the now
absolute reliance on IT infrastruc-
In a fast-changing environment, cre- ture, require a significant reinforce-
ativity and innovation are crucial for ment of the Internal Control System
companies to survive. Infrequent in these areas. Here, as discussed
physical presence in the office reduc- above, remote working contributes
es the occasions to work together on to the necessity to reinforce controls
less formal and more creative activi- and increases the inherent risks re-
ties, i.e. those which create innovation, garding the lack of confidentiality and
in different business areas and on dif- cyber threats.
ferent topics. Video calls are often too
“cold”, too structured, too focused on
the content to be discussed and too
Finally, how the impact of remote work-
little on relationships and emotions.
ing with its reduction or absence of
Since these phenomena are difficult
physical interaction on company cul-
to measure, at least at short notice,
ture, learning, and professional devel-
there is a risk of taking them into con-
opment affects internal controls still
sideration too late.
needs to be assessed. It is likely that
threats in these dimensions translate
into weaknesses in the Internal Con-
IMPACT ON THE INTERNAL CONTROL trol System and consequently need
SYSTEM to be mitigated. In particular, such
threats will have a significant impact
Remote
It is not easy to assess the compre- on control over non-standard or ad
hensive impact of remote working on hoc decisions, and potentially less on
the Internal Control System. The un- standardised, routine transactions.
derlying trend of digitalization moves
many standard controls into technical
In general, a response to these en-
hanced requirements on the Internal
Auditing
systems, where the controls them- Control Systems can consist in rein-
selves can be checked automatically. forcing controls at the basics follow-
Such digital processes are working ing a “security by design” logic.
8 Il Sole 24 Ore: “Lo Smart Working sta riducendo la ca-
pacità di creare innovazione”
20OPPORTUNITIES OF REMOTE WORK- suit of technical or soft skills. Since ways be a need to talk to the opera- processes and audit techniques, but
ING FOR INTERNAL AUDIT the world is not politically and demo- tors developing or using the digital also of the competencies to demon-
graphically uniform, location will con- tools, which in some cases can be strate authority, credibility, and eth-
Sophisticated and widely available tinue to be a significant differentiator done remotely, in some cases not. ical conduct which is essential for
digital tools are now a reality and en- irrespectively of digital connections. Care in testing is still needed to make valuable internal audit activity. This is
able collaborative working in virtu- Auditors need to be able to factor this sure that complete and accurate data not taught in a traditional classroom
al teams. Remote auditing can offer into their audit plans and work. is being provided from the source sys- context but developed through ob-
valuable opportunities to Internal Au- tem(s). serving others and working together
dit to manage costs more flexibly and in person. Working in close contact
reduce its travel expenses and opti- UNDERSTANDING STAKEHOLDER NEEDS with experienced colleagues enables
mize how audit skills are deployed. AUDIT NEEDS
junior staff to learn the everyday be-
A better use of skills in the most ap- Internal Audit should always consider
haviours which lead to successful
propriate ways and areas will lead to
MAINTAINING AUDIT EFFECTIVENESS the needs of its stakeholders, wheth-
auditing. Such exposure is curtailed
a better coverage of the associated er external, boards and non-execu-
The effectiveness of Internal Audit when working solely remotely since
risks by audit activities. Some audits, tive management, or executive man-
and the need to maintain the quality all interactions are planned to some
and some parts of audits (such as da- agement. It should be considered
of its work and to unearth root caus- extent; there is a limited opportunity
ta-intensive analysis) can be managed whether these needs are changing or
es is a prerequisite of all further con- to truly shadow someone or observe
without the need for extended physical have evolved during or further to the
siderations. Since companies change firsthand working practices.
interaction with auditees. If these au- Covid-19 pandemic, as well as and the
at a quick pace, also Internal Audit
dit activities are adequately identified resulting changes to business opera-
needs to adapt to make sure that its
and planned, they can offer increased tions and audit work.
approach and techniques remain
value-for-investment when being less THE LIMITS OF REMOTE WORKING
relevant to produce outcomes in line DIVERSIFYING SKILLS IN THE AUDIT FUNCTION
bound by the time constraints of tradi- FOR AUDITORS
with audit objectives. On the one hand AND DATA-DRIVEN ASSURANCE
tional onsite auditing. this means catching the opportunities GENERAL LIMITATIONS: RELATIONSHIPS, SPON-
in times of change, on the other hand In an increasingly digital world, Inter- TANEITY AND CONFIDENTIALITY
Sustained remote work, with the re- nal Audit needs to diversify its skills,
recognizing existing limits so that they
duction in commuting and travel times hiring IT auditors, data scientists and Working through the pandemic has
can be taken into consideration and
to distant locations, can also repre- those coming from related profes- demonstrated that a switch to full re-
their impact minimized. Particularly
sent a significant saving of time, po- sions. A corresponding shift to da- mote auditing is manageable in the
in a situation where spontaneous ac-
tentially translating into increased ef- ta-driven assurance is not the core short term. However, it relied to an ex-
cess to people and information is lim-
ficiency and productivity as explored topic of this document but treated in tent on staff already having built rela-
ited, there is a high risk of not being
above. This needs to be balanced with a different forthcoming ECIIA paper. tionships and already having a certain
fully aware of what is happening in the
the more difficult and potentially re- This trend is less influenced by remote amount of knowledge, carried along
company and hence missing changes
duced access to information when working and hence is more robustly by momentum. As the initial reference
in its risk profile.
working mainly remotely. aligned to different working models. point recedes further into the past,
CHECKING THE INTEGRITY OF INFORMATION the continuing ability of audit teams to
When the workforce is primarily loca- LEARNING ON THE JOB sustain effective auditing in the face of
tion-independent and works in a sig- The need to check the integrity of in- staff turnover in business areas and
nificantly remote environment, com- formation is not new, but it continues More than other professions, due to
in audit teams should be regularly ex-
munication structures and channels to be relevant despite the shifts to dig- reliance on professional judgement,
amined. New ways of managing dura-
can evolve. However, knowledge of italization and working from home. A Internal Audit leverages on on-the-job
ble knowledge and information flows
local operating environments (mar- majority of business processes being learning as a primary lever for indi-
will need to be developed.
ket, customs, competition, language, managed digitally does not mean that vidual development, particularly for
specific regulatory requirements and a computer is the only tool needed to those just starting out. This is because
expectations) should not be underes- audit those processes. There will al- becoming a good auditor requires
timated and balanced against the pur- not only deep knowledge of business
22 23RAPPORT, INTERACTION AND ACCESS TO INFOR- talking over each other. More gener- heavily reliant on paper documents IMPACT ON THE ADVISORY ROLE OF AUDIT
MATION NOT SPECIFICALLY SOUGHT
ally, all meetings needed for assess- and other manual activities can only
ing and understanding the auditable be transferred to home office to a very Since extensive remote working is in-
Conducting audits relying solely on creasing the siloes, making personal
digital contact can limit audit effec- scope (particularly in considering new limited extent, often with significant
or emerging risks and avoiding “blind losses of efficiency. Moreover, the relationships and informal informa-
tiveness, despite the improvements tion flows more difficult and present-
in video calling technologies which spots” through missed interactions move can have been made in emergen-
with senior business management) cy circumstances potentially disrupt- ing new challenges to stakeholder
continue to receive regular updates management, also the Advisory Role
and enhancements to features. It is are more effective in person. ing the effectiveness of the process
(for example where certain steps re- of internal audit can be negatively im-
more difficult to read body language, pacted.
Moreover, where the vast majority of liant on access to documents that are
establish tone, and build rapport and
communications across the compa- no longer easily available are missed).
relationships with auditees and the
ny are managed through electronic The same is true for any associated
business at large. It is also harder to
means, the fact that it is possible that controls: matching paper documents
derive insights that normally result
any or all might be retained on record is a logistical challenge where docu-
from in-person walkthroughs. A ben-
may result in more guarded discus- ments can no longer be accessed or
efit of face-to-face interactions is that
sions, less spontaneity and important are dispersed throughout the homes
they naturally create more opportu-
bits of information untold. Taken in of various members of staff. For such
nities to spend time developing a re-
combination, this can further impair processes and controls, the impact
lationship beyond the immediate en-
auditors in building rapport and run- on the ability of Internal Audit to ef-
gagement, which is important in being
ning effective interviews. fectively undertake a review is severe
a trusted partner to the business. This
is because auditors are more likely to LIMITATIONS OF TECHNOLOGY
and this follows through to corporate
spend time on non-work-related con- governance and the liabilities of se-
versation at the start or close of face- Depending on the location of the au- nior management.
to-face meetings, whereas “getting ditee and technology used, one of the
IMPACT ON JUDGEMENT AND AUDITABLE AREAS
straight down to business” is more main challenges organizations can
likely with electronic interactions, as run into is logistics. The reliability of Overall, the elements auditors rely on
is asking fewer questions. Moreover, network connections may vary by to exercise their professional judge-
face-to-face interactions tend to pro- location, which can cause interrup- ment are limited when parties work
duce more dialogue and a richer dis- tions in interviews and other meet- entirely remotely. The extent of the
cussion, particularly where the par- ings. Technology challenges can also limitation will depend on the specifics
ticipants do not know each other well impede document sharing, for exam- of the company and the scope of busi-
as is often the case during audits. ple if auditees have difficulty access- ness activities.
ing the VPN to show evidence. Solving
Fluid dialogue, during audits and out- network and application issues can Specific examples of audit activities
side audits, is a key requirement for be time-consuming and frustrating, that may be limited when conducted
auditors to exercise reasonable judge- especially when employees are work- remotely are walkthrough test (you
ment. Over-reliance on data without ing from home. Technical issues will only see what you are shown), audit-
contextual interaction is inherently hence result in a loss of productivity, ing certain activities (e.g. real estate,
limited as the data represents what and in worse cases a decrease in reli- facilities management, secure areas
the company already “knows”. Some ability of information and therefore in such as call centres or trading floors)
meetings with the business which the quality of assurance given by in- or on new/unclear processes or in-
are more easily managed in physical ternal audit. volving counterparts with a complex
proximity, such as delicate audit clos- relationship.
ing meetings where body language In cases where a company has a low
is key, and video can result in people degree of automation, process steps
24 25BEYOND THE IMMEDIATE, FRAMEWORKS SHOULD Although in times of acute crisis, In-
NOT FUNDAMENTALLY CHANGE ternal Auditors should be permitted
to support the business on critical ac-
Despite the changes introduced in tivities, once normality (which may be
reaction to the Covid-19 pandemic, different from the preceding normali-
in most cases Internal Audit’s activ- ty) resumes, this should be limited. In-
ities have resettled. The framework dependence from operations is a key
around reporting indicators (e.g. plan tenet of Internal Audit which enables
progress, business responsiveness objectivity and needs to be preserved;
to audits and remediation of issues) any activity which could create a con-
should not fundamentally change in a
6
flict of interest should be carefully
remote working environment. That is, managed and the pandemic does not
although for example the target dates change this requirement.
on certain issues may be legitimately
changed in order to take into account Internal Audit’s organizational chart
the crisis or the new emerging prior- generally reflects business opera-
ities, the way those changes are han- tions or is at least reactive to how
dled should be treated and reported in business operations evolve. As a re-
the normal manner with the legitima- sult, structural impacts of the chang-
cy validated case-by-case rather than es the business is going through with
applied by default. its own handling of remote working
and increases in automation may be
Audit plans should continue to be greater in the long term.
flexed to account for changing circum-
stances such that it is demonstrably
always “the right plan”. The degree of
that flexing may increase during times BUILDING ON THE RIGHT MIX OF PHYSICAL AND
of acute change or stress such as REMOTE WORKING
those introduced as the effects of the
Internal Audit should maximize the
Covid-19 pandemic and related public
opportunities of remote working, but
health policy changes come into force.
at the same time manage its limits,
Nonetheless, it remains important
balancing the remote and the onsite
to set and monitor a plan of work to
work in order to maintain audit effec-
provide a baseline that can be under-
tiveness. Auditors should make the
stood and challenged, and to which
most of digital tools. As remote work-
Internal Audit can be held account-
ing can result in the loss of occasions
able for its coverage, production and
for small talk or quick checks, digital
decisions. These decisions may result
Future of
tools offer a way of “chatting” which
in enhanced focus on particular ar-
can be particularly useful as senior
eas of the business and less attention
members of staff become used to be-
Audit Work
on others; the impact of such shifts
ing contacted in this way as it involves
needs to be transparent and justified
less formality than booking a meeting
such as to be approved by the compe-
and preparing an agenda. However, if
tent corporate bodies.
possible, in order to prevent impover-
ishing the relationship with the busi-
27ness, the main meetings with the busi-
ness should be managed in person,
where possible, to maintain the op-
portunity for less formal interaction.
Using agile techniques, that have
proven beneficial when teams are
physically together, can compensate
the limitations of fully remote work
and are compatible with virtual col-
laboration. The increased stakehold-
er engagement and communications
(both within and outside Internal Au-
dit) should enable teams to make the
most of the flexibilities and opportuni-
ties represented by remote work, par-
ticularly as companies in general are
adapting to remote work at the same
time as Internal Audit does. It also
means that both audit teams and busi-
ness stakeholders are better able to
manage their time flexibly focusing on
the areas of the audit with most value.
Where remote auditing is the chosen
approach for an assignment, the au-
dit team should consider making sure
that existing data analytics are antic-
ipated so they can complement the
remote interviews and identify areas
of particular focus during scoping ac-
tivities. The right investment of effort
needs to be considered so that data
can be effectively sourced and ana-
lyzed in time to contribute to the audit
work supporting the conclusions.
28CONCLUSIONS
It is not easy to predict to which de-
gree remote working will become per-
manent, either generally or, in partic-
ular, for Internal Audit. It is likely that
a balanced (“hybrid”) model between
physical and remote working, possibly
with greater geographic dispersion,
will prevail in the near future, as com-
panies are beginning to understand
7
the benefits and limits the new work-
ing models.
Internal Audit will consequently adapt
its way of working to best suit the mod-
el deployed by management. Internal
Audit should not be pre-empting such
changes, instead being sufficient-
ly flexible to accommodate chang-
ing circumstances, while remaining
closely associated with stakeholders.
Precise and timely information is key
for auditors, especially for punctual
high-quality risk assessments, an ap-
proach of prevention and the advisory
role. In-person interactions are and
will continue to be a key part of audit
work and of building fruitful relation-
ships, both needed to provide effective
assurance and add value.
Conclusion
31Email info@eciia.eu Avenue des Arts 41 Web www.eciia.eu 1040, Brussels-Belgium Twitter @EciiaInfo TR: 84917001473652 Phone +32 2 217 33 20
You can also read
