Duties of Internal Auditors in Times of Crisis

The time of crisis is the phase in which the symptoms of the crisis are ended and the consequences begin to be felt intensely, the damages of the crisis are felt the most and the crisis must be urgently intervened.

The time of crisis is also a phase in which information pollution and false news are common. In this phase, all stakeholders exposed to the crisis want clear, precise and accurate information about the crisis. However, due to the high level of uncertainty in this phase, it may not be possible to have sufficient and accurate information about the crisis.

Time of crisis is composed of two phases:

i. Escalation phase (acute period)

ii. Standstill and de-escalation phase (chronic period).

The escalation phase is the period when the first shock, turmoil and panic are experienced. The escalation phase ends with the first response to the symptoms and the escalation slows down. As the crisis management process for the solution of the crisis is operated, the escalation stops and the crisis enters de-escalation phase (Campbell 2004).

If the signals and symptoms in the pre-crisis period are detected and measures are taken, the severity of the threat to be exposed in time of crisis will be softer. In this period, the corporate management focused on priority tasks such as maintaining the organisational existence within the scope of crisis management and put routine oper­ational tasks into the background. In this phase, it is likely that some problems will occur in the processes of operating the controls designed with the routine activities of the organisation.

In an unpredictable crisis environment such as an epidemic disease that is very unlikely and has a devastating effect when it occurs, internal audit services should first be offered to mitigate the effects of the crisis and then return to routine activities. Considering the example of the crisis caused by the COVID-19 outbreak, internal auditors should quickly adapt to the outbreak environment in the “Time of Crisis”, which is considered to have started with the acceptance of COVID-19 as an epidemic, as the above symptoms are seen all over the world, and then evaluate carrying out the following activities;

• Since the management carries out more crisis-oriented activities during the crisis, there may be difficulties especially in complying with the legal regulations. This may create a legal sanction and reputational risk for organisations in the post­crisis period. Therefore, internal auditors can provide legal compliance-oriented assurance service in managing critical activities by working in coordination with legal units, if necessary.

• Asa result of the management’s focus on managing the time of crisis, ensuring routine controls to be operated efficiently is of secondary importance. In this case, internal auditors can provide an assurance service for monitoring controls designed specifically against critical and high-level risks (IAAA 2020).

• Increasing the awareness of the management regarding the possible abuse risks that are likely to happen in this process and can work on internal control weaknesses that will lead to abuse in all areas (Chambers 2020a).

• They can offer consultancy services for new situations (such as disinfection, employee health, social distance, transportation problems, remote working, lack of staff and twin assignment), especially in an unpredictable crisis environment such as the COVID-19 outbreak (Coderre 2020).

• Since it is a control of critical nature, internal auditors can oversee the fulfilment of some duties such as; staying at home for a certain period of time the employees showing fever, cough, headache and other defined symptoms and working from home until the situation is clear, following the isolation rules, applying to health institutions and the follow-up of their health conditions to be carried out by human resources units

• They can assess whether the employees who continue to provide services in the workplace comply with the occupational health and safety rules set out in the COVID-19 outbreak.

• They can evaluate the performance of alternative procurement and product distri­bution processes or alternative service delivery methods designed and operated within the scope ofbusiness continuity, which are considered as the most important activities for the organisation to survive.

• They can evaluate the performance and safety of the technological infrastructure, which provides uninterrupted internal and external communication of the organ­isation, within the scope of the “Communication Plan” and “Remote Access and Working Plan”, taking into account the information security procedures.

• They can follow the state of the organisation with regard to benefiting from local and/or international supports.

• By encouraging more frequent risk assessments with employees and helping iden­tify particularly potential risks that may arise during a crisis, they can play a facil­itating role in reducing the potential hazards the organisation will face (Chambers 2020b).

• They can actively take part in any position, when necessary, especially in crisis management teams—as staff with sufficient knowledge of all the processes of the organisation, to maintain its existence and continuity^[11] (Coderre 2020).

4.7