Internal Controls in a Remote World
As remote work takes hold at CPA firms and organizations, getting a grip on internal controls is essential for overcoming the security risks of an at-home workforce.
Before COVID-19, working from home full time was the
exception rather than the rule. According to a June 2020 survey
by IBM Security and Morning Consult, 83 percent of respondents
said that prior to the pandemic they worked from home either rarely
or not at all. In face-to-face, pre-pandemic office settings, employers
and IT teams managed, implemented, and monitored security
measures and protocols from a central location. Now those systems
“Managing internal controls in an office setting is one thing.
Managing internal controls when everyone is working from their
kitchen tables is another thing altogether,” says Bob Dohrer, CPA,
CGMA, chief auditor for the AICPA.
As pandemic concerns remain high, many workplaces plan to
continue remote work into 2021 and beyond, and organizations
may find themselves playing catch-up as they try to manage
potential security risks in a world where in-person oversight is
impossible and traditional controls are ineffective. The pandemic
has exacerbated the usual risks, with remote work, furloughs, and
layoffs all creating new weaknesses. “Suddenly there may be fewer
people available to process financial transactions, and that creates
pressure,” Dohrer says. “Combine all of this with issues surrounding
the segregation of duties, and teams that aren’t interacting in a live
setting, and problems can develop quickly. Controls designed for
the office just don’t work as well in a virtual environment. We have
a new level of consideration that has to take place.”
If you haven’t revisited your internal controls lately, now is the
time, says Jenny Deloy, CPA, MBA, Marcum LLP’s Chicago office
managing partner and Illinois region partner in charge of assurance
services. “Change, anxiety, and uncertainty are creating an
environment where fraud proliferates, and fraudsters are out there
with new scams to convince people to do things they wouldn’t
normally do,” she explains.
As a result, companies need to be very aware of the steps they can
take to avoid the opportunity for fraud, advises Elizabeth Sloan,
CPA, managing director in Grant Thornton’s Chicago audit
methodology and standards group: “Since we’re not all physically
together, we need to think about the basics. What changes have
occurred to the control environment because of remote work? We
need to be sure we’re thinking about the right things and not
Here’s how to ensure your internal controls remain relevant in a
Ten Steps to Developing Robust Remote Internal Controls
Step zero, Sloan says, is to embrace the change: “Think of this as
an opportunity to improve and build a more effective structure of
internal controls rather than just having an interim structure.” After
that, take these steps:
#1: Reexamine segregation of duties.
Look for gaps or dead ends
in workflows created by virtual work. How might duties need to
change or be restructured? If signoffs were previously handled
manually, how are they handled now? Has there been a loss of
checks and balances?
#2: Take advantage of technology.
Use secure portals to transmit
documents, leverage the cloud, and embed timestamps on files to
#3: Track, document, and confirm.
These steps are so basic that
they’re often overlooked, Dohrer says. Reach out to the information
sender. Confirm they sent it, and it’s what you received. Track and
document any changes made to approval levels, access rights,
procedures, or responsibilities.
#4: Know your data.
What data do you have? Who can access
it? Verify that data, including something as simple as a
videoconferencing link, is not publicly accessible or open to more
internal access than necessary.
#5: Find new lines of communication.
“Casually passing someone’s
office used to spark conversations,” Deloy says. “Now that you’re not
in front of someone, you might not hear about problems. Initiate
conversations on a regular basis and in a collaborative way. Make
sure you’re on the same page and pursuing the same goals.”
Consider checking in daily with your team and using video more
often than telephone or email.
#6: Assess cyber risk.
IBM’s report found that fraud has risen
dramatically since March. “Cyber risk assessment is crucial right
now,” Deloy cautions. “Provide teams with training and awareness
of cyber-related matters so they recognize current scams.” Now is
a good time to confirm your IT systems are in place and working
securely and that proper passwords, encryption services, and multifactor
authentication are in place.
#7: Get leaders involved.
“Those charged with governance need
to remain visible to employees, particularly in the accounting
function,” Deloy stresses. She suggests using live video for
meetings. “Your team needs to see leaders involved, monitoring,
and supporting positive behaviors. People want to do the right
thing. Provide the support they need to do so.”
#8: Draw attention to ongoing monitoring.
processes demonstrates to team members that someone is always
assessing the situation, and that can be a real fraud deterrent. “If
someone is considering bad behaviors, just knowing someone is
watching is helpful, even if they’re watching from home,” Deloy says.
#9: Remember the human element.
Don’t forget about the people
behind the processes. “Make sure team members are engaged
and not burned out,” Sloan recommends. “Working virtually in a
pandemic means the opportunity and pressure to potentially
commit fraud are already there. If people lose their engagement,
they can easily rationalize things they usually wouldn’t do.”
#10: Communicate with your clients.
A review of internal controls
presents a perfect opening for firms to reach out to clients. “Help
them think about these matters within their organizations, because
their attention is definitely elsewhere,” Deloy urges. “Take
advantage of this opportunity to advise, guide, and help your clients
revisit, refresh, and improve their internal controls.”
Different Can Be Better
Do you really need to think about internal controls differently in a
virtual world? Yes. Do organizations need to panic? No. Remember:
The fundamental principles don’t change. “You don’t need to adopt
a new framework and change everything,” Dohrer says. “Think
about a control objective in the manual world, and then consider
how that can be accomplished in the virtual world. Most businesses
and auditors will find that a good understanding of fundamental
principles will go a long way in this environment.”
Rather than dragging organizations down, virtual work and
rethinking internal controls and processes should be propelling
organizations forward, Sloan suggests. “At Grant Thornton, we’re
focusing on quality and are working smarter by utilizing more
advanced data. Examining data analytics has allowed us to be more
precise and to home in on specific risks,” she shares. “From a
technology perspective, remote work has helped us improve our
communication and use more tools to facilitate collaboration. We’re
not just doing what we’ve always done. Even when we’re back in
the office, we won’t go back to the way things used to be.”