Consulting Services Internal Controls During Times of Crisis
SHARE THIS

 

Last updated on 4/01/2020

As we all adjust to the changes presented in both our personal and professional lives as a result of the coronavirus pandemic, there is likely to be a significant impact to your organization’s internal control structure. However, the solution is not to eliminate the controls completely. As business processes are disrupted and key personnel may be unavailable, organizations need to be flexible, quickly adapt to these changes, and identify internal control adjustments to respond.

Because the internal control structure of each organization is unique, management must balance risk exposure, effectiveness, and efficiency of operations as well as any compliance considerations. The following are some example scenarios and modified internal control considerations:

Established Internal Control

Modified Internal Control Considerations

Sensitive documentation (financial, human resource related, or otherwise) is delivered to a specific office location.

  • Contact entities mailing sensitive information to determine if alternate secure methods, such as encrypted electronic mailing or remote deposits, are available.
  • If physical documentation is received, assign an employee to securely scan, store, and distribute as needed.
  • Separate the responsibilities of those receiving sensitive information from those who are responsible for processing or reconciling the information. 

Checks or other instruments require physical dual signature.

  • Consider an emergency delegation of authority to allow for checks to be signed by one individual following email authorization from other required signers.
  • Determine if temporary exceptions can be made to allow for resumption of operations remotely, while considering any legal implications or requirements.
  • Consider alternate forms of payment (e.g., credit cards, online or digital payments, bank transfers).
  • Perform timely bank reconciliations and assign the responsibility to a non-financial instrument authorized signer and those without access to records. At a minimum, consider having someone without signature authority review bank activity periodically (consider view-only access through the financial institution website).

Client or customer requests a change in normal business process (for example, a release or transfer of funds).

  • Determine who is authorized on behalf of the organization to communicate with outside parties, and adjust as needed. Restrict communications and inform employees of any changes.
  • Implement verification procedures to validate legitimacy of received requests (e.g., contacting customers or financial institutions at their authorized numbers).
  • Retain copies of all documentation to support client or customer requests and changes, and email copies per that client or customer’s information on file as confirmation of the change.

Documents or valued assets are physically safeguarded in an office location.

  • Perform an inventory count and move documents or valued assets to an alternate, secured location where they can only be accessed by authorized personnel.
  • Upon resumption of normal business processes, perform another inventory count and reconcile any transactions that may have occurred during the specific time period.

Overall, separating duties between the approval, access, and recording of transactions can assist in mitigating the inherent risk in processing. If your organization is unable to modify an internal control due to staffing or system limitations, consider implementing additional monitoring controls to bridge any gaps. Document changes in your processes and retain an audit trail of evidence, even if the change in process is anticipated to be temporary. Continue to evaluate internal controls as facts or circumstances change. Lastly, as you move to a more remote workforce, be sure your employees are aware of the best practices for working securely when working from home.

Do you need assistance evaluating or modifying your internal controls? P&N has a depth of resources to help identify relevant internal controls, gaps in processes, and provide recommendations to address the gaps. Contact us to discuss your organization’s unique needs.

Scroll to Top