Internal Audit and the COVID-19 Crisis: A C-Suite Perspective
May 18, 2020
There are four commonly known phases of crisis management: readiness, response, reassurance, and recovery. It has been approximately two months since the COVID-19 global pandemic crisis parked itself on the front steps of our colleges and universities and it is likely that no amount of readiness planning could have prepared us—or the world—for this unprecedented event. Not a corner of our institutions have gone unaffected.
At a time when there is much ambiguity, it is necessary to instill confidence and certainty in our senior leaders that internal audit is willing and able to be a trusted advisor.
By now, it is likely that your internal audit departments held initial conversations with senior leadership about their perspectives on what changes need to be made at your college/university. These conversations likely addressed the needs and concerns that are a part of the ongoing discussions around the “response” phase of the COVID-19 crisis. It is imperative to keep this dialogue going on a regular basis so that internal audit can adapt to emerging risks and offer their services to help fill in gaps needed to continue operations. At a time when there is much ambiguity, it is necessary to instill confidence and certainty in our senior leaders that internal audit is willing and able to be a trusted advisor by providing expertise, skills, and support across any area of the institution well into the recovery phase of this crisis.
To further examine how internal audit departments can support their colleges and universities, three questions were posed to C-Suite leaders across several campuses to provide insight into how auditors can meet the immediate and long-term needs of their schools. Some leaders are quoted below:
Question 1: What kind of support services from the internal audit function would be most helpful to you right now as you are navigating through this crisis?
“It is always helpful to have another set of eyes on things when change is happening so quickly. Under pressure, we can concentrate so much on providing a solution that might not follow normal vetting procedures so it would be helpful to have that person who is a step or two removed from the immediate issue that can helps up go back and check our work.” –Chief Information Officer and Vice President for Information Technology, The College of New Jersey
“I’d like to engage [internal audit] to assist in compliance and reporting requirements of the CARES act as they have quick turn-around. Similarly, I would ask [internal audit], in conjunction with assigned attorney from the Office of General Counsel, to see that our plans for use and distribution of funds are appropriate to the guidance from the Department of Education.” –Executive Vice President for Finance and Administration and University Treasurer, Rutgers University
“Viewing internal audit as a resource that can be engaged on the front end helps ensure the integrity of our processes.” –St. Joseph’s University Executive
Across the board, it is clear that internal audit can assist their institutions in understanding the compliance nuances around the CARES Act. As history would imply, it is likely that that the passage of the CARES Act will be accompanied by increased scrutiny through audits and investigations into potential misuse of funds. For many institutions, they are putting processes and procedures in place for the first time to distribute and monitor disbursement of funds. For others, processes may need to be changed in order to meet reporting requirements for distribution of federal funds. All of these changes are happening quickly to meet a crisis-level cadence of distribution, disbursement, and reporting. Having internal audit at the table for these discussions upfront can assist in mitigating the risk that our institutions will fall short of understanding and meeting federal requirements. This sentiment was echoed across campus leadership.
Question 2: What does success look like for your area at the end of the pandemic and how can internal audit help you long-term so that you can get there?
“Success would [mean] the university has maximized the use of emergency funds being made available.” –University President, Pittsburg State University
“It is imperative that we leverage what we’ve learned to redefine our future and who we are as an institution. Internal audit has an opportunity to reinforce these strengths by helping units appropriately navigate into new practices and procedures with rigor and consistency.”
–Senior Vice President and Chief Information Officer, Rutgers University
As our institutions redefine what higher education looks like, internal auditors must remain agile and informed to assist campus leadership with new and emerging risks.
As our institutions move out of the initial response phase and closer to a long-term recovery phase, there is an opportunity for internal audit to provide ongoing support through awareness and anticipation. It is imperative that audit departments have the ability to shift and continue pivoting with the changing risk landscape. There is a lot of discussion and speculation around how the COVID-19 pandemic will alter the future of teaching and learning. Online learning or a hybrid online/in-person environment will likely become a strategic priority for every institution. Financial implications of decreased revenue and increased costs will be far-reaching into multiple fiscal years. And this is just what we can anticipate now. As our institutions redefine what higher education looks like, internal auditors must remain agile and informed to assist campus leadership with new and emerging risks as a result of the pandemic.
Question 3: Since working together is a key component of institutional success, which internal relationships are you most concerned about maintaining that internal audit can help you foster?
“Throughout this crisis we have had to work very closely with our Chancellor unit as well as Central Finance. Internal audit can ensure that all pertinent information is provided to the units in a timely manner—meaning at the Federal, State and [institutional] level.” –Chief Financial Officer, Rutgers School of Dental Medicine
“We need to get much better at the use of data to provide actionable information to the leadership team(s), and [internal audit] can be part of that proactive effort by lending its thorough understanding of quality and quantity (and paucity where applicable) of the underlying data.”
–Executive Vice President for Finance and Administration and University Treasurer, Rutgers University
While not always the popularly held opinion, internal auditors are—and should be—in the business of customer service and relationship building. By providing a value-added service to customers, auditors can begin to build the foundation of trust that is required to be a trusted advisor. This is particularly important during periods of fast-paced, high-pressure decision-making that will affect all aspects of an institution. A major risk at all of our institutions is units operating in silos. Working in silos may cause tunnel vision, duplication of efforts, fragmented components of a process, missed information required for a broader audience, and it can hurt productivity and team cohesion. Internal auditors can help facilitate conversations between the right people who are experts in their specific units. Even if an internal auditor does not know the correct answer, they probably know who at the institution has the right answer and can connect those individuals to collaborate and work in tandem towards a solution.
Questions to Ask at Your Institutions
While the responses above from institutional senior leaders provide some insight to assist internal auditors in understanding where to focus efforts, each college or university will have considerations that are unique to them and may alter the immediate needs of the school. To maximize the value that you can add at your institution, here are additional questions you can ask key leaders, and ask them regularly (e.g., quarterly), within your institution to better understand the specific needs that exist due to elevated and emerging direct and indirect risks:
- How has your risk management process changed to account for any new strategic risks?
- What risk areas are your top priority and focus right now? Areas to consider asking about include, but are not limited to:
- Telecommuting
- Student Credits (room and board or other)
- Grading Policies
- Financial Aid and CARES Act Disbursements
- Impact on Research
- Discretionary Spending
- Purchases Sent to Employee Homes
- What are some long-term risks you anticipate looming on the horizon? (For example, consider the impact of short-term risks on your institution’s accreditation.)
- What actions has the university taken, or are planning to take, to mitigate these risks?
- What are you doing to monitor future emerging risks, especially those that result from current actions being taken?
- Has the university’s risk tolerance changed at all and how has that impacted the enterprise risk management (ERM) framework?
These questions serve the purpose of helping internal audit assess how management identifies risks to see if they considered the complete risk landscape and are re-evaluating risks on an ongoing basis. Internal audit’s value comes from being able to know our organization and operations well enough to be able to identify, understand, and anticipate risks. This is a way for internal audit departments to determine potential areas to assist and for management to realize and recognize that internal audit can provide much-needed guidance and services.
This transformation will set the stage for internal auditors to remind our leaders that our institutions are able to adapt to change effectively.
If there is one thing that this pandemic has taught us, it is that institutes of higher education are resilient. Institutions had to modify how they have done things in the past to acclimate to the remote environment we find ourselves in. Changes that we once thought would have taken five years have taken five weeks. This quick adjustment is showing institutional leaders what has been done historically might not actually be the “only way.” This transformation will set the stage for internal auditors to remind our leaders that our institutions are able to adapt to change effectively. We must use this as an opportunity to promote how a flexible and open mindset will lead to progressive change throughout the institution.
These have been challenging times, to say the least, and it is important for institutions to keep pivoting and moving forward. Hold after-action debriefs often, recognize mistakes and learn from them, and remember to celebrate the wins. Our institutional leaders can and should rely on their internal audit departments to be a contributing factor to the anticipated success we are all aiming for—a graceful rise from the ashes.
About the Authors
Marilyn Carnevale
Marilyn Carnevale is a Certified Public Accountant (CPA), Certified Internal Auditor (CIA), Certified Government Financial Manager (CGFM), and Public School Accountant (PSA). She is the editor of College and University Auditor and works...
Read Full Author Bio
Marion Candrea
Marion Candrea is the Associate Vice President, Internal Audit & Advisory Services at Boston University. Prior to joining BU, Marion also held roles as the Chief Audit Executive at Ohio University, where she led the Office of Audit, Risk, and...
Read Full Author Bio
Marion Candrea
Marion Candrea is the Associate Vice President, Internal Audit & Advisory Services at Boston University. Prior to joining BU, Marion also held roles as the Chief Audit Executive at Ohio University, where she led the Office of Audit, Risk, and Compliance, and at Rutgers University in the Audit & Advisory Services group, where she began in higher education in 2008. Marion spent the beginning of her career working at Ernst & Young in its Risk Advisory group, based out of New York City.
Marion received her Bachelor of Science in Accounting from The College of New Jersey and is both a Certified Internal Auditor and a Certified Fraud Examiner. She is a member of the Institute of Internal Auditors and the Association of Certified Fraud Examiners. Marion’s involvement with ACUA began more than 15 years ago. Her volunteer services to the organization have spanned the gamut, including Co-Director of the Governmental Affairs Committee, participating as a mentor in the ACUA mentorship program, Board Member-at-Large, and most recently serving as ACUA’s President on the Board of Directors. She has participated on several QAR peer review teams at member institutions and has attended countless ACUA conferences.
candream@bu.edu
candream@bu.edu
Articles
How to Stay Ahead in an Ever-Changing Regulatory Environment
Internal Audit and the COVID-19 Crisis: A C-Suite Perspective
Letter from the President
Letter from the President