Strengthening Internal Control in the COVID-19 Environment

Are internal controls still designed and operating effectively in the remote environment? As the evolving COVID-19 pandemic brings uncertainties, organizations face immediate risks impacting their control environment. The pandemic has caused many to transition to a work-from-home framework, but your most important internal controls may not have kept pace with these rapid process changes. The design and operating effectiveness of internal controls needs to be reviewed to ensure these arrangements remain fit for purpose. –Kevin Congo, Harris CPAs
 
Due to its mission-driven purpose, a nonprofit organization’s financial and operational sustainability is significantly impacted by its environment. Natural disasters, economic slowdowns and unforeseen events are just a few factors that can adversely affect nonprofit organizations. That is why a strong internal control system has always been a priority for audit committees and management of nonprofit organizations. They’ve established policies to address the primary question—“what could go wrong?” Now nonprofits are facing the challenges of dealing with the results of the global novel coronavirus (COVID-19) pandemic, which include a scattered and remote workforce. As a result, management of nonprofit organizations are asking themselves—are the internal controls that were once effective still operating in a manner to achieve our objectives in this unprecedented time? What can nonprofit organizations implement in order to adapt to this remote environment, when their employees, resources, technology and documentation may only be accessible through virtual means?
 
Below are five tips that nonprofit organization management should consider to strengthen their internal control environment in response to a remote environment:

1. Re-evaluate risks

Due to the ever-changing environment the pandemic has created, prior to re-assessing internal control systems, risks must first be reevaluated. Every nonprofit organization’s circumstances related to COVID-19 will be unique. Additional risks that impact the organization’s financial position may arise. Audit committees and management should ask themselves questions such as “How has COVID-19 impacted the organization’s liquidity and capital resources? Is there now uncertainty about our ability to meet the covenants of our debt agreements? Have new cybersecurity and data integrity risks resulted from our digital working environment? Does our business continuity plan need to be re-assessed?” Developing plans and strategies to address questions such as these is crucial to help navigate this new reality.

2. Reassess the existing control environment in response to reevaluated risks

Although a nonprofit organization may periodically reassess and test its internal control system to ensure it is working properly, we have now entered an unprecedented time, where reassessing controls takes on a whole new meaning. What proved successful in the past may now result in control gaps when taking into consideration new risks such as a remote work environment, digital reviews/approvals and virtual documentation. Internal controls should be reassessed to determine if current existing controls are in fact targeting the specific risks now at hand. Nonprofit organizations may have to make changes in order to use the information and resources available to them at this time. This could result in a change in both operational and financial policies and implementing new policies. Roles and responsibilities may have to be adjusted. Contingency plans may have to be formulated in response to the new risks that have arisen. For many nonprofit organizations, controls around donor-restricted and government grant funds may need to be enhanced. Current system capabilities may have to be explored to determine if there is the potential to automate controls. The overall implementation of amended controls is essential to thriving in this changing work environment.

3. Strengthen segregation of duties

Segregation of duties is often a challenge for nonprofit organizations, depending on their size and complexity—the smaller the size, the bigger the challenge. This challenge intensifies even more in a COVID-19 environment, where the separation of duties, which may have been enforced before, now appears less pragmatic when all parties are working remotely, and circumstances are constantly changing. Questions such as “Who is establishing the controls and who is monitoring them?” need to be revisited. For instance, in a virtual environment, is management able to clearly distinguish between who holds physical custody of an asset versus who does record keeping for that asset? Furthermore, who has the authorization to approve transactions? Leveraging technology to enhance controls is one way to assist in clearly distinguishing between roles and responsibilities. Technology can provide collaboration tools and additional layers of approval that can help ensure that controls are enforced and appropriate segregation of duties is maintained.

4. Document key areas

Key areas represent those higher-risk financial statement areas that require comprehensive and robust supporting documentation. Management of nonprofit organizations should exercise extreme caution in ensuring significant areas such as management estimates and expenditure/cost tracking are thoroughly supported by documentation. The expectation of well-documented management estimates has always existed—however, in this rapidly changing environment, reasons and explanations of how an estimate is being recorded are more imperative than ever. The estimation should include written assessments of the thought process as well as reasons for any changes from prior years. This especially comes into play when considering the impact of COVID-19 on goodwill impairment, going concern evaluation and any potential additional debt requirements. These represent areas that may likely need renewed consideration and reinforcement when documenting underlying rationales behind the estimates. Additionally, proper expenditure/cost tracking has become increasingly important. Whether nonprofit organizations are incurring expenditures specific to COVID-19-related costs or receiving government relief funds, the methodology behind identifying and tracking these revenues and expenses is vital to a nonprofit organization’s financial position. A nonprofit may consider recording COVID-19-related funds received and expense incurred in separate cost centers. Detailed supporting documentation needs to be maintained to support these amounts.

5. Don’t be afraid to seek assistance from outside experts

In order to perform their oversight function, audit committees, boards of directors and management of nonprofit organizations might need assurance that the new information and data they are processing is of the utmost quality. As new matters arise, outside experts can help the organization better understand best practices as well as help to monitor and assess the effectiveness of internal controls. They can also address complex accounting and auditing questions or assist with reviewing controls related to cybersecurity and privacy risks. External experts can also identify opportunities for nonprofit organizations by helping them understand the eligibility provisions for additional relief funding with respect to the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Templates and tools can be provided to the organization to help them better understand the calculations behind the relief packages available to them.

By Carla DeMartini, CPA

(This article was originally published in BDO’s Nonprofit Standard Newsletter, Summer 2020 on bdo.com. Harris CPAs is an independent member of the BDO Alliance USA.)

Share this Post