Author: Mark Harrison

Over the last year the COVID-19 pandemic has spread across the world at an unparalleled pace, bringing a level of disruption and devastation that will shape a generation and define the global social and economic landscape for at least the next decade. Although impacts have varied from country to country, the world has collectively experienced a profound change and a new era of ‘never normal’ is predicted, characterised by unpredictability and fast changing shifts in cultural norms, societal values, and behaviours. So, what lessons can we take away from what we have experienced so far and what role can internal audit play?

Impact

The impacts of COVID-19 have been varied and far reaching, with repercussions for health, social, economic, and business outcomes.

Health

There have been an extraordinary number of infections and deaths from COVID-19, however, the pandemic has also contributed to other health impacts. For example, fear of exposure to COVID-19 or lack of accessibility to medical professionals leading some to miss out on treatment for other conditions, and deteriorating mental health as a result of worsening economic conditions and social isolation.

Social

The pandemic has caused significant social changes both through formal rules and restrictions in place, and informal changes due to social pressure or health concerns. There has been an increase in social isolation (especially for people with disability and the elderly), unemployment, and homelessness, as well as profound changes to work and schooling as many places moved to remote environments, in some cases exacerbating existing inequalities and placing increasing strain on families and communities trying to adjust to these new ways of existing together.

Economic

Through border closures, government-imposed lockdowns, health risks and fear of infection, social pressure to stay home, job losses, need for public investment etc. the virus has also contributed to significant economic changes that have shaped the last 12 months and will continue in some form for at least the next few years.

Business

The combination of these varied health, social, and economic impacts are having a profound effect on strategy, customers, workforce, operations, finance and technology for businesses and organisations around the world, requiring fast pace and repeated adaptation.

Lessons learned

Observing successful and less successful adaptations to the pandemic, some general lessons emerge:

• • Move at the customer’s pace
  • Have a globalised mindset
  • Identify the right platform, data, and technology
  • Build an augmented workforce strategy
  • Think about the future in a different way

However, in addition to these general lessons, it is important for organisations to understand and evaluate their own pandemic response to identify important lessons that relate to their own unique circumstances. This is where internal audit can help.

Role for Internal Audit

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. With this skill set, internal auditors are well placed to conduct a post-crisis review focusing on an organisation’s pandemic response which can be a highly valuable exercise to assist the organisation to better adapt to future impacts whether pandemic related or not.

A post-crisis review would typically go through the following steps:

1. Documentation of the response – Typically the documentation of key decisions and response features is poor – as the focus is more on survival and less on accountability and transparency. Documentation is important as it may be relied upon in future inquiries or legal matters.
2. Technical investigation of the cause – An investigation of cause will be of greatest value if impact on the organisation is disproportionately higher than for similar or related organisations. A “root cause analysis” is an effective approach to use here.
3. Quantification/explanation of impact – While most business leaders will be well-across the impacts of the pandemic, there will be instances where leadership is so deep in the tactical response, that they cannot see the longer-term and strategic impact. Although not a “typical” internal audit output, internal audit can add value in these circumstances through a research or issues paper to prompt discussion, or facilitation of an executive workshop.
4. Assessment of the effectiveness of the response – This is a “typical” structured lessons learned project, which assesses the actions taken against a normative model. Assessments should be cognisant of the circumstances in which actions were made in order to be sympathetic and realistic.
5. Enhance organisational resilience – Organisational resilience is “the ability of an organisation to anticipate, prepare for, respond and adapt to incremental change and sudden disruptions in order to survive and prosper. An engagement that brings learnings from the broader analysis of impacts on business, as well as the experiences facing the organisation, and takes both a historical perspective as well as a forward-looking perspective will have the greatest potential impact on organizational resilience.

Key challenges and better practice

For a lessons learned activity such as a post-crisis review to be effective, an organisation should consider the following factors:

• Does the organisation have a learning environment? Without that it is difficult to gain traction.
• There must be accountability for acting on the lessons and lessons must be genuinely embedded. (Many of the lessons of previous pandemics have been forgotten).
• Data collection needs to be structured.
• For maximum impact, aim for a combination of top-down and bottom-up.
• Ensure the project has leadership sponsorship.
• Bring in expertise as required to ensure capability and credibility.
• Be clear on the value you are proposing to add.
• Be practical – theoretical constructs will not be seen as helpful.
• Be sympathetic and balanced.
• Focus as much on positioning the organisation for the future, as commenting on the past.
• In conduct and reporting, be conscious of the operating environment.
• Every single lesson does not need to be acted upon – focus on a few most valuable lessons for action.

A normative model of better practice crisis response

The following key principles can be used to guide a post-crisis review of an organisations performance in response to the pandemic (or any other crisis).

• Strong, active organisation leadership with the right capacity, capability, engagement, and focus.
• Clear governance arrangements which take effect early and are applied consistently.
• Clarity of roles and expectations for direction from, and information to, the Board.
• Timely and robust documentation of key decisions and actions taken to ensure transparency and accountability.
• Relevant (principles-based) planning (preparedness, operational response, risk) in place and understood to guide the organisational response.
• Redundancy in key roles in case of infection or requirement for a break.
• Timely implementation of non-medical risk mitigation strategies to reduce infection and maintain business continuity.
• Supply chains are reinforced to support access to necessary equipment, materials reliably through the pandemic.
• Nimble and adaptive leadership approach with continuous sensing and response.
• Reliable access to relevant and timely environmental and operational information and data to support decision making.
• Create capable capacity that leads key disciplines essential to the response.
• Creative and collaborative yet disciplined (and risk-aware) problem solving – quickly.
• Internal and external communication that is clear, disciplined, frank, consistent, timely and empathetic – educate, ameliorate fears, engender trust and enable people to remain connected.
• Relevant policy changes are made and published on a timely basis (privacy, hygiene, leave, amongst others).

Depending on resourcing and capability, a post-crisis review could be conducted internally or through engagement with an external provider. Sententia Consulting has capability and experience in this area and would be happy to assist your organisation. Contact us to find out how we can help you today.