Transforming Internal Auditing during the COVID-19 Pandemic and Beyond

Publication Date: December 7, 2022

Two years into the COVID-19 pandemic, universities, together with their internal audit shops, have resumed normal operations, or more accurately, settled into their new norms. To reflect on the gains and losses occasioned by the pandemic, eleven chief audit executives (CAEs) from public and private universities in the U.S. were invited to participate in individual interviews. Looking back on this challenging time, the CAEs provided personal accounts on how their resource and audit work was impacted. And, more importantly, they offered a post-pandemic outlook on the future of the internal audit profession.

Managing Auditor Shortage

Many internal audit shops experienced budget cuts and hiring freezes during the pandemic. To manage the impact of budget reductions while meeting the demand of audit work, CAEs began restructuring vacant positions (e.g., change an IT audit manager position to an entry-level data analyst position) or “cannibalizing” positions to allow for salary increases for the current staff. Some shops also hired accounting student interns to mitigate staff shortages.

At the same time, the job market also became more challenging for the audit shops in higher education, especially for those located in or close to large cities. Due to the shortage of accounting professionals across industries, more job candidates were attracted by the relatively high salary and opportunities in private industry. Work-life balance is not the selling point it once was for higher education, as many organizations have allowed staff temporarily or permanently to work from home. It has become extremely challenging for audit shops in higher education to find highly qualified candidates. So much so, that many hired headhunters to fill their vacant positions.

Utilizing Data Analytics

When the pandemic hit the U.S. in March 2020, universities had little time to prepare for initial campus shutdowns. Then, two weeks of “flattening the curve” became one month. And one month then became three months or even longer. When university employees largely worked from home and facilities on campus were closed, internal auditors had to brainstorm new ways to conduct audits. Several CAEs increased the utilization of data analytics, which does not require physical access to facilities or in-person interactions. In fact, adopting data analytics was easier than before, because the whole organization started reengineering manual processes to make working from home possible and effective. This change in the organizational environment created a great opportunity for internal auditors to broaden the scope of data analytics. It also enabled them to connect different data sources and creatively investigate issues at the organizational level.

Reevaluating Audit Plan and Risk

Due to physical access constraints, many audit projects had to be delayed or removed from audit plans. For example, one CAE had to remove a scheduled space management audit from an audit plan, because after the campus shutdown, the buildings on campus were no longer in use. And, as another example, audits scheduled in university medical centers during the peak of the pandemic were indefinitely delayed. Given the high COVID exposure risk to internal auditors and the high stress level of the medical center staff, CAEs chose to save these projects for more appropriate times.
As organizational and working environments changed during the pandemic, CAEs reevaluated audit plans to mitigate the risks that emerged during the pandemic. They planned audit projects to manage risks associated with: remote work, federal pandemic relief funds, FERPA compliance, and information security. The need for supporting external audits, such as audits conducted by federal and state agencies, also increased significantly for some audit shops.

Increasing Consulting Activities

When audit clients were “swamped by work” in the middle of the pandemic, the last thing that CAEs wanted to do was to create more work or, worse, distract their audit clients from their critical responsibilities. Consequently, the value of consulting work became more salient during the pandemic. Besides regular audit work, internal auditors gradually stepped into the roles of trusted advisors for management. They provided consulting services that directly addressed clients’ needs and assisted clients who struggled during the public health crisis. For example, internal auditors advised clients on how to improve business processes. They analyzed the existing manual business processes, identified issues and risks, and worked with clients to design more efficient and effective electronic working processes. Occasionally, an audit project transformed into a consulting project, because the clients needed more support through internal auditors’ consulting work during this critical time.

“Hallway Conversations”

When people began working from home, the primary method of communication quickly switched from in-person meetings to virtual meetings. Virtual meeting software, such as MS Teams, made it more convenient and efficient to “meet” and connect with people. However, much informal conversation that typically occurs during in-person meetings was lost. And these lost “hallway” or “watercooler” conversations with management turned out to present one of the biggest challenges for CAEs during the pandemic. Internal auditors often develop important insights from casual conversations with management, and these informal conversations happen literally by bumping into people within brick-and-mortar buildings. Beyond building personal connections, these conversations provide internal auditors opportunities to stay updated with the university’s operations, understand university culture, and better appreciate perceived existing issues and risks.

Internal Auditing beyond the Pandemic

Although the pandemic has accelerated the use of data analytics in internal auditing, internal auditors must remain committed to exploring new methods of incorporating data analytics into their work product. Since many manual business processes transformed into electronic processes during the pandemic, internal auditors now possess many more doors through which to investigate the interrelationship among different databases. Internal auditors are, thus, now poised to make novel uses.