How can we help with Coronavirus?

Carrying on as if nothing has changed makes no sense to me.

We should be asking “how can we help?”

The answer for risk practitioners should be clear: work with management to ensure that the organization is prepared and capable of responding promptly and appropriately to:

• A breakdown in the supply of materials
• An inability to deliver products or services to customers
• The forced closure of a part of the business, such as a factory or a call center
• The loss of key personnel who come down with symptoms
• The inability of a competitor to deliver products or services (an opportunity!)
• A surge or drop in demand
• …and so on

It may not be as easy for internal audit to know its place today, even for the next months.

But carrying on as normal is unacceptable.

What was identified as the top risk when you did your audit planning and risk assessment, what you are auditing as your read this, is almost certainly not the top risk today.

So set your audit plan aside.

How can we help management (and the board, but less directly)?

For example, when I was CAE, members of my staff were part of the crisis response team. Some:

• … stepped into temporary operations roles to supplement the management team
• … helped with the communications process, calling members of the emergency response team
• … acted as secretaries and scribes during meetings of the emergency response leadership
• … got out of the way. We didn’t ask management to stop planning for or responding to an emergency so they could answer our audit questions

We also were not shy about working with management to upgrade their response plans and procedures. If the plans were lacking, and the best people to upgrade them were my audit staff, I told them to go ahead. We can draft the plans and let management review and approve. You can question whether that stepped over the independence line; my answer is that I did what was right for the organization and management still made all the decisions. The board approved warmly.

Sometimes, we facilitated meetings to review, upgrade, or even develop response plans.

We should be talking to management and asking “how can we help?”

Perhaps we can review some of the planning that has been done, not to find fault but to make sure everything has been thought through.

Maybe we simply call around and collect information about preparedness and response so we can collate and report it to management.

If management in a location is understaffed and having trouble putting a plan together, we can often help. We may know of another location that has a good plan and can help the first one modify and adopt it. If they simply have no idea what to do, we don’t stop to write an audit report; we get to it and help them write the plan.

What we don’t want to do is perform an audit of Coronavirus responsiveness and deliver a report in six weeks.

We need to act with agility to help the organization get through this, making informed and intelligent decisions now.

We may have a business card that says we are internal auditors. But we are part of the management team and our first duty is to help the organization succeed.

I welcome your thoughts.

By the way, my friend Richard Chambers will be sharing his thoughts on this topic next week. Check him out at https://www.theiia.org/centers/aec/blogs/Pages/blog-chambers-on-the-profession.aspx or https://iaonline.theiia.org/blogs/chambers