Life after lockdown: The view from audit

While digital advances continue to influence how audits are conducted and how evidence is gathered, as well as aspects of the reporting process, the nature of the audit process still focuses on engagement and direct interaction with the audited entity. But risk assessments for 2020 audits will look entirely different to what we are used to, explains Dr Paul Winrow, Director of Professional Standards at Baker Tilly in our latest podcast.

The end of Saly?

“As auditors, we often rely on the concept referred to as Saly – ‘same as last year’. But COVID-19 is forcing us to approach an audit of a company, even if we are the longstanding auditor, as if it was the first time we have performed the audit.

“While historically a lot of time is spent on the detail in risk assessment, I think this year the approach will be to take a step back. To look at the impact of COVID-19 on the entity and think about the things you are required to do in a risk assessment.

“What has been the impact of the pandemic on the client’s industry? What are the regulatory changes and government schemes that have been brought in to deal with the pandemic: how will you deal with government loans, furlough schemes? How have the client’s business operations been impacted, their clients, their supply chains? How is the entity financing itself going forward? Has there been an impact on bank covenants? Has the entity had to take out extra loans?”

And the implications don’t stop there. The objectives and strategy of a company will likely be very different because of the pandemic. Many will have new short-term objectives focused around survival, and a redefined strategy for the next 2-3 years to get back to ‘normality’.

Control environments will also likely have faced a huge shake up, explains Winrow. Not just financial systems controls, but how management overall controls the business, including IT controls.

“For many businesses this is the first time they will have had teams, en-masse, working remotely. For that to work you need appropriate control environments, and those environments will change as the phases of the pandemic change: from pre-lockdown, to lockdown, to post lockdown and, hopefully, a physical return to the office.”

The perfect storm

The risk of fraud increases during times of crisis. This is particularly true in terms of financial reporting as the pressure mounts on businesses to maintain a strong financial performance.

But if you are going to commit a financial reporting fraud, you need the opportunity to do so. And a crisis like COVID-19 presents the perfect storm.

“If ever there was an opportunity to get around controls, or in the case of management to change controls in a way that allows them to commit a financial reporting fraud, it is now.

“COVID-19 has caused upheaval through lockdown and remote working and thrown companies into shock. It has also presented the illusion of greater opportunity to ‘get away’ with fraud: if auditors are working remotely, how will they pick up anomalies? Are tax authorities less focused right now?

“As auditors, we always talk about professional skepticism – and it's never been more important than it is right now. We have to be acutely alert to any possibility that a client may be looking to commit fraud in this way.”

The driving force for change?

Partial and total lockdowns are placing limitations on collecting audit evidence, and the pandemic could well be the driving force for change in the audit process.

“Post COVID-19, we won’t be turning up and finding 25 lever arch files for us to review on a table in a dusty room. COVID-19 has forced our hand to do things differently, to accelerate the pace of change, to embrace technology for sharing information.

“We need to be taking advantage of recordable technology – whether that’s as simple as a phone, or a tablet, or even drones to carry out inventories of larger sites. Electronic data sharing, and accepting electronic evidence, is also moving up the agenda when it comes to audits.”

Independent challenge - the role of internal audit

The pandemic has shone a light on the pivotal role that internal audit has in assessing immediate risks to a business.

Sitting alongside, but not part of, the firm’s crisis response teams and management, internal auditors can provide that independent challenge to what is going on in real time, rather than assessing things retrospectively. Their role is also crucial in terms of longer-term planning and helping management assess what the medium-term might look like and how they’re going to manage associated risks.

It’s certainly an interesting time for a profession that has traditionally done things the ‘old fashioned way and likes to touch a piece of paper’. Auditors are faced with conundrums around digitalisation versus the human element. The moral hazard vs changes in regime. Listen to the full podcast: Life after lockdown: the view from audit.

Meet the expert

Dr Paul Winrow

Director of Professional Standards