Internationally, the internal audit community is working to contribute to the fight against COVID-19. Indeed, epidemics and natural disasters (See the investigations on Rita and Katrina in the United States by the Inspectors General, the General Accountability Office, the IIA publications on Ebola, the latest publications of the Institute of Internal Auditors in recent days on COVID-19) demonstrate the other side which is the need for a nation and their organizations to be prepared to face crises and disasters, especially in terms of risk management, business continuity management and others similar requirements.
Indeed, by definition and to simplify it a bit, internal audit specialists are experts in risk management, internal controls, corporate governance and performance assessment (See the definition of audit internal by The Institute of Internal Auditor or the General Accountability Office, and even by so many other bodies of this kind!). Through this series of articles, we provide advice while disseminating that of certain experts, members of the internal audit community, risk managers, internal controls and specialists in corporate governance. In addition, their work highlights the need not to neglect new emerging risks which take several forms and modalities:
Bacteriological, not counting those related to artificial intelligence, cyber security, data protection, regulatory complexities, technologies, culture, ethics, and sustainability). Finally, let us remember that the treatment of epidemics and disasters requires the intervention and contribution of a variety of actors. This article and those for the next few days are part of such a concern.
In fact, for auditors and managers, even those responsible for corporate governance and organizations, risk management involves assuming a number of requirements:
- assume this responsibility and this need for anticipatory governance of risks, in particular their scope in order to face them;
- determine the processes in place to ensure that they enable health workers and other stakeholders to meet their contributions in the face of peril;
- help managers and governance (boards of directors, risk, ethics or other committees) to maintain planning that enables their organizations to deal with risks and catastrophes and to have effective plans;
- deploy internal audit in an auditable, or even evaluable, environment, due to the existence of treatment, continuity and mitigation plans allowing internal auditors to test their effectiveness using various planning criteria, skills, etc.
Management, governance and management supervisors thus have to institute and perform a series of procedures:
1. Keep people safe, away from the risks of the coronavirus and in appropriate places, including employees, citizens, customers, suppliers, partners. Containment is in particular one of the approaches (despite the debates on the relevance of the process.)
2. Identify the levers and engines of growth and value creation and all that is necessary to ensure the protection of resources, short-term survival, and continuity of operation!
3. Integrate criteria such as sustainability, continuity, security into the strategic perspective: is research and development for you? The continuity of production, even of the apparatus for the production of goods and / or services? In some cases, this infrastructure can be a digital platform that ensures its dissemination! In doing this reflection, have you taken into account the critical skills required? Human? Technological? Ability to work remotely, online, telecommute more generally? How to ensure their maintenance? The continuity? Morale and motivation?
4. Share the governance of the organization with staff and the various managers (board of directors, audit and / or risk committee, etc.). Avoid taking the bull by the horns, all alone, and solving all the problems yourself, defining and taking on the issues and required actions. Rather, seek to build a comprehensive and integrated view to understand the diversity of risks, in particular what is now called emerging risks.
5. Communicate well, with compassion and empathy, efficiently and effectively on the risks, management systems, internal control and risk management in relation to the risk of the current coronavirus, this towards all employees. Based on the lessons learned, review the risk management, governance and internal control process.
Thinking about the post-crisis period
Besides individuals, organizations will have been victims of this crisis. This has multiple macroeconomic dimensions that are said to deepen in the coming weeks or months; it is also an economic and financial crisis of which we are beginning to see the first trends in the stock market, the first announced bankruptcies, and layoffs, as in the United States, for example. It is perhaps an opportunity to reflect on a set of paradigms which until now have constituted the foundations of a liberal and capitalist system, of the world economic division: the mobility of goods, services, people, velocity of transactions, the magic market which would have this faculty of regulating, of arbitrating, a China factory of the world, an America master of science,
- Think about the modalities that will ensure short-term survival, during an intermediate phase. In this regard, assess the impacts and induced damage affecting survival capacities, the availability of liquidity and the resources to revive the system. Evaluate and simulate in this regard, self-financing capacities, capital losses or losses of income, the weight of costs incurred at the time of the coronavirus. Sketch out various scenarios, both optimistic and pessimistic. Compare!
- Involve stakeholders who would have the capacity to support the turnaround and help financially, including shareholders, citizens, suppliers, customers, funders and donors.
- Learn lessons and formalize new processes intended to improve risk management, internal controls, and to strengthen resilience in the face of new health or other crises.
- Invest in risk management systems, internal controls that strengthen the capacities of health and other organizations and in the governance of organizations (boards of directors, risk committees or other strong and independent boards or committees, endowed with expertise required).
- Develop continuity, relief and crisis management plans, because this experience, like those of the past, demonstrates the urgency of effective planning centered both on the achievement of objectives and on the risks of non-achievement objectives.
- Build a society prepared and able to mobilize in the face of risks, coordinate decisions and transform threats into opportunities.
- Assume the requirements of discipline, land use planning, control and sanctions of anarchies embodied by individuals, organizations, annuitants or other disruptors ... Demonstrate strategic and civic leadership to act on organizational and social culture .
- Get stakeholders to think beyond the immediate crisis and consider its long-term implications on value and production chains, business collapse, productivity, growth, loss of income, etc. Indeed, it seems that a severe economic crisis is emerging, at least during the next few months.
Include in the governance of control the construction of companies and organizations resistant to fraud in accordance with international standards and good practices ...
- Set up a monitoring-evaluation and strategic thinking system that auditor, investigators, internal or external evaluators can and must document.
In total, internal Auditors in UAE and other evaluators across the world strive to make major contributions to strategic thinking and action. Prevention is better than cure, they say. In this sense, their contributions, from experts accustomed to the analysis of crises, dysfunctions, catastrophes and risks, remind us that the treatment of phenomena such as crises invites mobilization and collective action. .
Wrestling is everyone's business, each in their areas of expertise and experience. Do not hesitate to share your experience and complete each of the above points as needed?
