I tipi di file classici non potranno più essere utilizzati a partire da gennaio 2021. È possibile effettuare la transizione dei file classici o scaricare un PDF. Ulteriori informazioni

Control Impact Due to COVID10

Richiedi una demo

I'm curious to know how other companies have been impacted in performance of controls due to COVID19?  And how you are approaching testing of controls/ quarterly sign offs , and assessment of deficiencies?   For example, if a key control in operations which normally operates monthly will now only be done quarterly due to resource constraints do you consider that a control deficiency for timeliness, OR do you consider the change  the environment and as long as the risk is covered just document the reason for change?

0

Commenti

4 commenti

Data Voti
  • Elaine Shinn

    I am curious as well as to how different companies are handing this.  We are currently in the process of discussing each key control with the process owner to determine if changes have been made and what those were. 

    0
  • Donna White

    So far we only know of one control changed due to COVID and it had to do with the manner of approval evidence.  We moved from using scanned documents to email since so many people are working remotely. I added a footnote to testing and explained why the nature of the evidence changed and why bthe change was needed but did not all it out as an exception. I would think if a control's frequency needs to change and the risk is still addressed, it would be a control change, not a control deficiency, unless the change had not been approved prior to implementation. For example, if someone took it on themselves to execute a control quarterly but didn't get the process owner to sign off on this.

    We send all our narratives out for review for Q1 through Wdesk, using certifications, and any changes will be noted there. So far, nothing related to COVID has been noted; only expected changes due to system changes. 

    0
  • Stephanie Campese

    We sent a communication out and have a daily stand up specifically with Finance. We have a communication for those that use to do physical sign off on how to transition to electronic sign off (which should have happened a long time ago lol).  Our biggest risk at this time is the detective controls may not all operate timely (we had a major impact to resources due to offshoring and who would have ever thought BCP planning should include a risk that like a light switch suddenly one day 100% of your workforce would have to work from home with no prior notice- big lessons learned happening in todays world).

    I was thinking that as long as it is documented , and there is adequate coverage to mitigate a material misstatement, then there is no deficiency it's a timing constraint to to a catastrophic (one time event), maybe increasing the reserve slightly for the "could have" factor  , then an action plan to have the timing adjusted and "caught up" by end of Q2 then no deficiencies would be issued.

     

    0
  • Rosemarie McParland, CISA, CRISC, CICA

    We sent an additional certification out for 1Q specific to the impact of COVID-19 on the control environment. Our external auditors were provided the responses as well to ensure they were comfortable with the responses. We only had one control change and that was a quality assurance review control and that only had a change in how the QA team pulled their samples but based on our discussions with our auditors we were all comfortable with the change and there were a number of mitigating controls downstream from that to provide additional coverage. We too had some email approvals in place of manual wet signature approvals and we are nothing that in our testing. We are not calling any of these out as exceptions.

    0

Accedi per aggiungere un commento.