With the impact of COVID-19 extending further every day, its impact on organizations’ Sarbanes-Oxley (SOX) programs is unlikely to be their top priority. However, despite the fact that the SEC has allowed for some delay in filing dates, business continues. Internal controls must still be executed and documented, even if in a different manner than was done historically. Continuing to pay attention to controls and the related documentation and continuing to work with control and process owners will save time and effort later in the year.
We understand that companies need to adjust today, especially calendar-year companies currently compiling results and preparing reporting for Q1. In the table linked below, we have compiled a list of adaptable approaches for completing SOX obligations in the current unusual environment (click on image to enlarge). While the focus for many companies right now will be on short-term solutions, we are also including recommended long-term solutions. These longer-term improvements can help organizations get ahead of the game in future disruptive situations.
Other Control Reminders
While there may not be time to update all process and procedure documents now, control descriptions should be updated to reflect changes to procedures to ensure that testing occurs against these revised practices. Organizations may consider facilitating a control certification, even if off-cycle from their typical annual or quarterly frequency, to ensure that control owners have adjusted the control design and the timing of execution to still adequately mitigate risk and document their activities. When company reaction begins to settle down, it will be important to reassess any temporary changes in control design and operation to ensure that control processes continue to remain in alignment with the organization’s risk appetite.
The situation created by the COVID-19 pandemic will require organizations to dust off their “significant and unusual” transaction controls and the related management review considerations. Similar treatment will be needed for going-concern and debt-covenant controls, along with disclosure controls and procedures over information presented outside the basic financial statements. Organizations should consider the guidance provided by the SEC Division of Corporate Finance with regard to financial reporting matters related to COVID-19. With the pandemic hitting the U.S. at the end of calendar Q1 2020, there will not be much time to quantify the impact, record adjustments needed, draft disclosures and work with external audit through Q1 filings. It’s important not to lose sight of retaining evidence for management review controls.
Companies in certain industries are furloughing staff and shuttering or substantially reducing operations. Individuals may also be off work for some time due to illness or caring for family members. This can result in the period-end close being performed with fewer or substitute resources. It can also result in failure to execute key controls essential to management’s assertion regarding the effectiveness of internal control over financial reporting. It is in times like this that organizations with detailed policies and procedures, documented methodologies, and job descriptions that detail internal control responsibilities find themselves at an advantage. For example, it is helpful to have a record of how a resource who may be out for an unforeseeable duration calculated that reserve or completed that analysis. During and after the crisis, it is important for organizations to emphasize the importance of documentation and make sure it is available and readily retrieved when it is needed. And, of course, ensure the execution of key controls.
Organizations can enact the practical tips shared here in the short term to avoid adding ineffective control execution to the list of challenges to overcome in financial year 2020. Adopting the long-term considerations we suggest above can make the next business disruption less stressful than the last several weeks have been.
Protiviti’s SOX Champions Network contributed to this content. For more blogs in this series, click here.
