Are internal controls still designed and operating effectively in the remote environment? As the evolving COVID-19 pandemic brings uncertainties, organizations face immediate risks impacting their control environment. The pandemic has caused many to transition to a work-from-home framework, but your most important internal controls may not have kept pace with these rapid process changes. The design and operating effectiveness of internal controls needs to be reviewed to ensure these arrangements remain fit for purpose. –Kevin Congo, Harris CPAs
1. Re-evaluate risks
Due to the ever-changing environment the pandemic has created, prior to re-assessing internal control systems, risks must first be reevaluated. Every nonprofit organization’s circumstances related to COVID-19 will be unique. Additional risks that impact the organization’s financial position may arise. Audit committees and management should ask themselves questions such as “How has COVID-19 impacted the organization’s liquidity and capital resources? Is there now uncertainty about our ability to meet the covenants of our debt agreements? Have new cybersecurity and data integrity risks resulted from our digital working environment? Does our business continuity plan need to be re-assessed?” Developing plans and strategies to address questions such as these is crucial to help navigate this new reality.
2. Reassess the existing control environment in response to reevaluated risks
3. Strengthen segregation of duties
Segregation of duties is often a challenge for nonprofit organizations, depending on their size and complexity—the smaller the size, the bigger the challenge. This challenge intensifies even more in a COVID-19 environment, where the separation of duties, which may have been enforced before, now appears less pragmatic when all parties are working remotely, and circumstances are constantly changing. Questions such as “Who is establishing the controls and who is monitoring them?” need to be revisited. For instance, in a virtual environment, is management able to clearly distinguish between who holds physical custody of an asset versus who does record keeping for that asset? Furthermore, who has the authorization to approve transactions? Leveraging technology to enhance controls is one way to assist in clearly distinguishing between roles and responsibilities. Technology can provide collaboration tools and additional layers of approval that can help ensure that controls are enforced and appropriate segregation of duties is maintained.
4. Document key areas
Key areas represent those higher-risk financial statement areas that require comprehensive and robust supporting documentation. Management of nonprofit organizations should exercise extreme caution in ensuring significant areas such as management estimates and expenditure/cost tracking are thoroughly supported by documentation. The expectation of well-documented management estimates has always existed—however, in this rapidly changing environment, reasons and explanations of how an estimate is being recorded are more imperative than ever. The estimation should include written assessments of the thought process as well as reasons for any changes from prior years. This especially comes into play when considering the impact of COVID-19 on goodwill impairment, going concern evaluation and any potential additional debt requirements. These represent areas that may likely need renewed consideration and reinforcement when documenting underlying rationales behind the estimates. Additionally, proper expenditure/cost tracking has become increasingly important. Whether nonprofit organizations are incurring expenditures specific to COVID-19-related costs or receiving government relief funds, the methodology behind identifying and tracking these revenues and expenses is vital to a nonprofit organization’s financial position. A nonprofit may consider recording COVID-19-related funds received and expense incurred in separate cost centers. Detailed supporting documentation needs to be maintained to support these amounts.
5. Don’t be afraid to seek assistance from outside experts
In order to perform their oversight function, audit committees, boards of directors and management of nonprofit organizations might need assurance that the new information and data they are processing is of the utmost quality. As new matters arise, outside experts can help the organization better understand best practices as well as help to monitor and assess the effectiveness of internal controls. They can also address complex accounting and auditing questions or assist with reviewing controls related to cybersecurity and privacy risks. External experts can also identify opportunities for nonprofit organizations by helping them understand the eligibility provisions for additional relief funding with respect to the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Templates and tools can be provided to the organization to help them better understand the calculations behind the relief packages available to them.
By Carla DeMartini, CPA
(This article was originally published in BDO’s Nonprofit Standard Newsletter, Summer 2020 on bdo.com. Harris CPAs is an independent member of the BDO Alliance USA.)
Share this Post