Risk Management and Internal Controls During COVID-19 Pandemic

COVID-19 pandemic wreaks havoc on everywhere. In just a few weeks, there have been important changes in our business and social life.  While issues such as transferring the daily routine to the house suddenly, experiencing social distance for the first time and having travel restrictions deeply affect our social life. Furthermore, the demand has decreased, and this has automatically affected the supply chains. Financial markets, which have been always very fragile, also got their share from these developments. The companies seriously losing their income and profitability due to the contraction of demand in the middle of a crisis try to manage staff relationships in an increasingly complex environment and critical issues in the supply chains in this slippery ground.

The organs responsible for the corporate management (board and audit committee) and the management have an essential responsibility in this crisis management. As part of effective risk management, these organs need to address the problems they face and take the right steps in these difficult times to protect the company.

No matter how shocking the crisis caused by the COVID-19 pandemic is, companies should not compromise the check and balance system. Otherwise, new problems that emerged during the crisis may affect the company as much as the impact of the crisis. Risk management practices and regular evaluation of internal controls are critical to maintaining this balance. Companies should be able to identify new and emerging risks, evaluate existing risks and mitigate the possible effects of these risks with controls during this difficult period.

You may find the issues to be considered regarding internal controls in such a deep crisis, as follows.

Control Environment

• COVID-19 pandemic can cause significant changes in the control environment. For instance, with the start of the epidemic, many companies were temporarily closed, and the working environment moved to the houses. As a result of the remote working regulations, it is possible that the companies would have significant changes in the control environment and the previously designed controls will not work in the new order.
• The attitude of organs responsible for corporate governance (such as board, audit committee) and management will be crucial for ensuring a discipline across the company and a crisis plan that should be followed in this crisis environment.
• The board and management should frequently communicate about risks regarding the crisis and the factors that trigger them. It would be wise to make maximum use of the experience of the board of directors and the audit committee in managing risks.

Risk Evaluation

COVID-19 should not turn out to be a “survival” period for companies.  While strictly following the risks that need to be managed in a crisis environment, not to miss new opportunities can provide significant gains in the medium and long term.

Knowing the awareness levels of employees across the company about the risks in the crisis environment will be critical for the institution to get ready for this environment as a whole.

Control Activities

Companies should periodically make sure that their controls work as designed. However, due to COVID-19, companies have made significant changes in their daily business practices and business processes in a short time. In the COVID-19 process, it is very possible to encounter some big changes in companies such as remote working arrangements, facility closures, or lack of resources due to diseases and other reasons. Change is risk by nature. It is essential for a balanced and optimally functioning internal control system in the crisis environment, to evaluate new risks caused by changes triggered by COVID-19 in processes, to implement controls related to these risks quickly, and to ensure that existing controls are re-evaluated and working effectively.

Information and Communication

While experiencing the COVID-19 pandemic, it is necessary to ensure that information flows properly at all levels of the company and to all stakeholders outside the company affected by this crisis. It may be also useful to understand the crisis experience in the same sector and other sectors, and to apply the suitable experiences in your company. Besides, the company management should be attentive to use a proper language in communication of crisis management to prevent unnecessary sensitivities.

Monitoring Activities

It will be essential to monitor the crisis management constantly during this period. By immediately implementing corrective actions and reporting to senior management regularly, it is possible to have an improvement even during the crisis. Continuous monitoring of operational environment to identify potential issues that trigger the crisis and understanding of the effects of these issues and taking corrective measures will relieve the system.

The board should keep in mind that the operational management, which is the first line of defense during COVID-19, is shocked. They should also be aware that it is possible to observe that the operational management can show some weaknesses in their practices while carrying out the responsibility of managing risks according to the company's goals, which is one of their primary duties. At this point, the second line of defense (such as risk, quality, financial control, legislation and compliance functions) supporting the first line of defense, and the third line of defense which is internal audit, may be more prominent.

Establishing the risk and control balance at an optimum level in the crisis will be very critical in the solution of the crisis besides other elements that need to be followed according to the crisis plan.