COVID-19 Risks: CAE Panels

May 18, 2020

COVID-19 has become a disruption to “business as usual” and we all had to adapt quickly, whether we were ready to or not. Even ACUA’s Audit Interactive conference was cancelled due to the pandemic and redesigned into ACUA’s Virtual Event (“The AVE”). During the inaugural event, two Chief Audit Executive (CAE) panel discussions were held on audit shops’ responses to COVID-19 and risk mitigation efforts put in place. Julia Hann facilitated the first session with medium and large audit shop CAEs: Sharon Kurek, Joe Malesweski, Carolyn Saint, and Eulonda Whitmore; and LaDonna Flynn facilitated the second session with small audit shop CAEs: Alison Bogart, Rita Moore, and David Terry. LaDonna also interviewed former CAE and current Chief Financial Officer, Betsy Bowers.

Risk Considerations

COVID-19 changed the way we view risks and, as a result, our audit plans. What once was deemed a low likelihood and impact event has suddenly elevated to high. What was once an important audit is now not so relevant. These panel discussions identified the following areas to review, including risks identified and activities to consider, when updating audit plans or engaging in future advisory services.

Information Technology (IT)

Most institutions were not prepared to go 100% online and certainly were not ready to do so within a matter of days. The switch to an online culture essentially overnight created a strain on IT. These strains contributed to a number of critical IT risks, such as a lack of adequate VPN licenses, stress on infrastructure due to increased volume, and disaster and continuity planning. Not only did an institution have to be ready to go online, they had to consider whether their students had the resources to be able to learn in a remote environment, as well. Several universities purchased laptop for their students and/or created remote hotspots in parking lots for students to continue their learning. Both added risks to the university.

EDUCAUSE recently reported that most institutional leadership is preparing for IT budget cuts.

An audit department that had aging infrastructure on its risk assessment in a prior year more than likely experienced a more difficult time during the emergency response in March. Despite increasing infrastructure pitfalls with technology, EDUCAUSE recently reported that most institutional leadership is preparing for IT budget cuts. Leaders are planning to reduce spending on less essential services, such as auxiliaries’ systems and classroom technologies, but support cloud and online learning systems.

Human Resources and Personnel

Preparing faculty, staff, and leadership for remote operations warranted a reevaluation of how personnel risks are looked at. For example, who are essential employees? Who needs to stay on campus and work and who can work from home? Was there enough guidance for employees on teleworking? Half the panelists' institutions had a telework policy already in place, but the other half had to create one quickly.

Unfortunately, fraud risk is already on the rise—from false workers compensation claims and unemployment schemes to procurement card fraud.

Remote learning was completely new to many faculty members and making the switch from in-person teaching to virtual learning was difficult. The way courses were structured and conducted in-person posed challenges to success in a virtual setting, which created a whole new set of risks for an institution. Ensuring enough training for faculty and staff of new online resources identified a lot of new risks, as well. Will aging faculty and vulnerable populations want or need additional time off or retire suddenly from the stress of a changing society? Some universities are looking at these risks as part of their return to campus plans.

Due to the financial constraints experienced by many institutions, there is the possibility of furloughs and/or layoffs for staff and faculty. As a result of increased pressure and uncertainty, the panelists indicated that, unfortunately, fraud risk is already on the rise—from false workers compensation claims and unemployment schemes to procurement card fraud.

Student Matters

While panelists had different views on the risks, it was apparent that ensuring student success is the top priority driving our university presidents. Every institution wants to:

Understand and address the risks associated with declining enrollment
Identify at-risk student populations that might need additional financial assistance
Offer flexibility to grading to compensate for new at-home work environments
Provide safe accommodations to students who cannot leave
Supply food and shelter safety to those who cannot leave
Make available mental well-being resources for students
Grant practicum and internships adjustments

Lastly, refunds and complaints may be on the rise, which could lead to reputation and litigation risks if not properly triaged and handled.

Financial Implications

Undoubtedly, there are uncertainties with financial budgets for the next several fiscal years, which will be a component to every institutions’ risk assessments. Some of the financial hardships mentioned by the panelists included:

Decreased enrollment and decreased tuition revenue
Lack of revenue from auxiliaries and events
Salary freezes and spending freezes
Unbudgeted and unfunded costs for remote learning, personal protective equipment, and sanitization

Nevertheless, there are some positive potential opportunities that arise from financial hardships:

Cost savings through streamlined processes
Increase in automated workflows
Cost savings in utilities and construction through extended work-from-home arrangements
Increase in more energy efficient construction with a new view on space utilization

Research

Research at large research universities may be halted due to COVID-19. Health Systems are preparing for the unpredictability of the future and potential furloughs/layoffs due to the loss of grant support and/or inability to conduct research.

35% [of session participants] used ERM to identify a risk identification approach with COVID-19 and discussed establishing a risk tolerance.

Enterprise Risk Management (ERM)

A portion of the panel discussion with large and medium universities included enterprise risk management. At Virginia Tech, an ERM approach is used to establish a risk tolerance with senior leadership. Identifying opportunities in the recovery phase of emergency management will be critical for business continuity. Survey results of the participants in the session stated that 35% used ERM to identify a risk identification approach with COVID-19 and discussed establishing a risk tolerance.

Compliance

New or emerging compliance issues that colleges and universities are facing include:

Monitoring of additional compliance requirements from the new Governor’s Emergency Education Relief Fund (GEER Fund) and Coronavirus Aid, Relief, and Economic Security Act (CARES Act)
Additional risks related to the American with Disabilities Act (ADA) for both students that are remoting learning and employees working from home
Noncompliance with debt covenants due to reduced revenue and cash on-hand

Mitigation Efforts

So what are audit departments doing to address the risks at their universities? Panelists gave several ideas, including:

Providing advisory work by reviewing policies, procedures, and processes that are being changed due to working from home
GEER Fund and CARES Act compliance reviews
After-actions debrief reviews–help review emergency management and leadership’s actions during the decision-making process of the pandemic to identify lessons learned and successes
Performing data analytics of procurement card data and spending to identify any irregularities
Sitting on task forces to review, and provide input on, various budget model scenarios to plan for potential decreased enrollment and decreased state funding
Adding a section to each current audit asking how has COVID-19 affected the department (e.g., changes to processes, changes to business continuity plans)
Presenting the changes in funding and compliance to leadership
Reviewing refunds processed to students caused by closing campuses

Polling Questions

To engaged attendees and better understand insights provided, these sessions posed several polling questions. These questions, as well as attendee responses, are below.

What type of institution is your college/university?

(Please note the above question did not total 100% due to non-responses.)

Have you changed or are planning on changing your current audit plan for COVID-19?

This pandemic will result in many positive opportunities impacting Higher Education. Which do you think will have the greatest improvements?

Conclusion

These panel discussions revealed the key risk concerns that different institutions are facing, as well as the adjustments being made to mitigate these risks. Audit offices will need to consider a number of different areas, as addressed above, when developing their audit focus going forward. CAEs and audit shops should continue to talk (through email, on the phone, or even through video chat) to individuals around the university to remain informed about any additional emerging and elevated risks, as well as known and potential impacts stemming from COVID-19. These risks seem to be changing daily and these challenging times give internal audit departments a chance to showcase how adaptable and knowledgeable they really are.

About the Authors

Julia Hann

Julia Hann serves as Director for University of North Florida Office of Internal Auditing. Julia earned a Bachelor of Business Administration in Accounting from Kennesaw State University and a Master of Business Administration from Georgia College. Julia is a certified public accountant (CPA) and certified internal auditor (CIA). Julia takes a proactive leadership role to perform internal audits, consulting, trainings, and risk assessment coordination. She has more than 15 years of internal audit work experience; previous employers have included Georgia College & State University, California State University Chancellor’s Office and The City of San Diego.

Julia currently serves ACUA as President. Past ACUA positions have included Chair of the Internal Audit Awareness Committee from 2014 to 2015, and Annual Conference Director from 2011 to 2014. These positions helped increase conference attendance and vendor participation and proved to be an exciting time to be a part of the professional education committee. She has also previously served ACUA as a track coordinator and proctor at past conferences.

Julia also plays an active role with The Institute of Internal Auditors (IIA) and led the formation of The IIA Middle Georgia Chapter. This has given her the opportunity to attend several IIA leadership academies. She is a past president for The IIA Middle Georgia Chapter and currently serves on the Northeast Florida IIA Chapter Academic Committee.

julia.hann@unf.edu

Articles
COVID-19 Risks: CAE Panels
Letter from the President
Letter from the President
Letter from the President

LaDonna Flynn

La Donna is the Director of Internal Audit at Pittsburg State University in Pittsburg, Kansas. She has been in this role for the past six years. Prior to joining PSU, LaDonna was an Internal Auditor for 15 years in the healthcare and electric utility industries in Tacoma WA and Tucson AZ. She earned a Bachelor of Business Administration from PSU. She is scheduled to complete her MBA at PSU in the fall of 2019. La Donna is also a Certified Internal Auditor (CIA), Certified Public Accountant (CPA), and Certification in Control Self-Assessment (CCSA).

At PSU, she serves on several committees including Data Classification Committee, PCI Committee, Student Employee of the Year Committee, and Kelce College of Business Internal Auditing Education Partnership (IAEP) Advisory Board. She is the contact person for PSU’s Compliance and Ethics program. Each academic year she is an active mentor to the newly appointed graduate assistant in her department. She is a frequent guest speaker for PSU’s Internal Audit class.

Some of LaDonna’s ACUA contributions include: track coordinator, proctor, speaker, lunch table topics host, and ACUA Booth Coordinator at past annual conferences, 2014 midyear host committee member and proctor, Are You Auditing Your Student Health Center? article author for the College and University Auditor Journal, past Internal Audit Awareness Committee Chair, and current Recognition Committee Chair. lflynn@pittstate.edu

Articles
COVID-19 Risks: CAE Panels