Your Business’s Policies and Procedures Post Pandemic

Every business found themselves pivoting almost overnight to operate in new and very different ways, especially when it came for their business’s policies and procedures post pandemic. For instance, many businesses felt the impact of a decade’s worth of technological adoption in just 3-6 months. Also going fully remote, again almost overnight, businesses had to find new ways to get their work done just to keep running. For finance departments specifically, this posed a major issue that has gone unaddressed for many companies. Finance departments rely on comprehensive internal control frameworks to maintain proper operating, reporting, and compliance functions. More granularly, this is executed through policies and procedures for substantially all major workflows for the finance department. But what happens when your business processes change almost overnight? In the midst of all these changes when everyone is working overtime to stabilize the business, businesses need to circle back to make sure that any process changes still meet all the relevant objectives for their internal control framework. When making these policies and procedures post pandemic, take a good look at what you have to change and how it might affect your business practices for years to come.

How Business Processes Changed During the Pandemic

Since the pandemic started over a year ago, businesses have changed the way they operate in order to stay afloat. Finance departments were forced into working remotely and taking on a different role from what is normally expected out of their department, often adding additional responsibilities. Simple day-to-day business processes like paying bills, processing payroll, or collecting payments have been impacted in a variety of ways. Remote access to systems and tools was an obvious issue. Many businesses also struggled to perform key controls because they required certain paper documentation or physical signatures. Other situations arose because stabilizing the business meant teams were downsizing, and remaining team members were pushed into new roles and added responsibilities. Segregation of duties broke down, and teams with significant turnover had trouble training or cross-training staff rapidly for their new duties. It’s important to note that even though businesses had to transform rapidly, and were able to stabilize, for the most part, they still are responsible to maintain proper internal controls.

How Internal Control Risks Have Increased

When it comes to risks, the pandemic has provided ample opportunity for finance departments for strong departments, let alone ones with weak internal controls coming into the pandemic. Internal control risks are now higher than ever because processes are breaking down or not being followed consistently. The ramifications can become widespread and pervasive if left unaddressed, including but not limited to:

• Potential for fraud
• Errors financial reporting giving management and the Board bad information
• Significant delays in reporting, with downstream effects delaying management’s ability to make important decisions
• Compliance failures which could result in contractual disputes, banking issues, problems with investors, fines and penalties, as well as an assortment of other negative externalities
• Weaknesses in controls can lead to IT security weaknesses as well depending on the specific workflow

Overall it’s difficult to understate what the potential ramifications are if too many key controls break down with too many key processes.

What Businesses Should Do With Their Policies and Procedures Post Pandemic

A comprehensive assessment of their policies and procedures to identify, evaluate, and mitigate risks. This is done via an assessment to find gaps where the current business processes are not designed or functioning properly to ensure the business meets its operating, reporting, and compliance objectives. The COSO Internal Control Framework is the benchmark your business should use if it’s not already. This can be done internally by your finance team, or a consultant can step in to provide extra support if your team is already overwhelmed with their current workload. One point of note is that one of the components of the COSO Framework is a risk assessment, which requires businesses to identify significant changes in the business and address how it impacts internal controls. During the pandemic, every business saw significant change. If you haven’t already considered the relevant risks, your business already has its first deficiency in internal controls.

Components of the COSO Internal Control Framework

While there are numerous sources to provide a deeper analysis, a quick summary of the components of internal control are as follows:

Control Environment is the first component of the internal control framework, which represents the overall tone set by the Board of Directors and management in relation to 1) integrity and ethics 2) oversight and monitoring 3) proper structure and lines of authority 4) building a competent workforce and 5) building a culture of accountability.

Risk Assessment is the second component that requires businesses to set relevant control objectives, identify and analyze risks including fraud risks, and address whether changes in the business impact internal control (as noted above).

Control Activities are the third component that requires businesses to design and implement proper control activities, for operations overall and IT specifically, to be deployed via corporate policies and procedures.

Information and Communication is the fourth component requiring businesses to identify pertinent information and communicate both internally and externally.

Monitoring is the final component in which businesses do ongoing reviews and evaluations of internal controls. As deficiencies are identified they need to be evaluated and addressed.

What A Comprehensive Assessment Looks Like

The pandemic has created a strong need to take a fresh look at your internal control framework. A comprehensive assessment will require you to review via walkthroughs and interviews all your significant business processes to determine if the internal controls are still 1) effectively designed and implemented 2) still functioning properly 3) still support the business’ operational, reporting, and compliance needs. This will result in an analysis of the current state of operations, what the future desired state is, and recommendations to fix the gap. Finally, you’ll need to plan and implement any necessary changes, as well as applicable training for staff.

It is no doubt your business has seen dramatic changes since the pandemic, and hopefully operations have stabilized. However are you still comfortable that the finance department’s controls are still operating effectively? If you’re concerned and need support or simply guidance on where to start, please reach out to me here.