mug with the word "begin" on it
PHOTO: Danielle MacInnes

Carrying on as if nothing has changed makes no sense to me. We should be asking “how can we help?”

The answer for risk practitioners should be clear: work with management to ensure the organization is prepared and capable of responding promptly and appropriately to:

  • A breakdown in the supply of materials.
  • An inability to deliver products or services to customers.
  • The forced closure of a part of the business, such as a factory or a call center.
  • The loss of key personnel who come down with symptoms.
  • The inability of a competitor to deliver products or services (an opportunity!).
  • A surge or drop in demand.
  • … and so on

Set Your Risk Audit Aside, It No Longer Applies

It may not be as easy for internal audit to know its place today, even for the next months. But carrying on as normal is unacceptable.

What was identified as the top risk when you did your audit planning and risk assessment, what you are auditing as your read this, is almost certainly not the top risk today. So set your audit plan aside.

How can we help management (and the board, albeit less directly)?

For example, when I was chief audit executive (CAE), members of my staff were part of the crisis response team. Some:

  • Stepped into temporary operations roles to supplement the management team.
  • Helped with the communications process, calling members of the emergency response team.
  • Acted as secretaries and scribes during meetings of the emergency response leadership.
  • Got out of the way. We didn’t ask management to stop planning for or responding to an emergency so they could answer our audit questions.

We also were not shy about working with management to upgrade their response plans and procedures. If the plans were lacking, and the best people to upgrade them were my audit staff, I told them to go ahead. We can draft the plans and let management review and approve. You can question whether that stepped over the independence line. My answer is that I did what was right for the organization and management still made all the decisions. The board approved warmly.

Sometimes, we facilitated meetings to review, upgrade or even develop response plans.

Related Article: Crisis Communications: Are Your Staff Getting the Message?

What Internal Audit Can Do to Help

We should be talking to management and asking “how can we help?”

Perhaps we can review some of the planning that has been done, not to find fault but to make sure everything has been thought through. Maybe we simply call around and collect information about preparedness and response so we can collate and report it to management.

If management in a location is understaffed and having trouble putting a plan together, we can often help. We may know of another location that has a good plan and can help the first one modify and adopt it. If they simply have no idea what to do, we don’t stop to write an audit report; we get to it and help them write the plan.

What we don’t want to do is perform an audit of coronavirus responsiveness and deliver a report in six weeks. We need to act with agility to help the organization get through this, making informed and intelligent decisions now.

We may have a business card that says we are internal auditors. But we are part of the management team and our first duty is to help the organization succeed.

I welcome your thoughts.

(Author's Note: My friend Richard Chambers shared his thoughts on this topic here and here.)