The lasting impact of COVID-era audits

Between a presidential impeachment, social justice protests, climate disasters, and, briefly, murder hornets, 2020 has been quite a year. And of course, nothing has shaped the country quite like COVID-19. Nevertheless, the people working in credit union risk management seem to have kept their cool.

“Working from home, we had risks that we didn’t have before,” said Angela Garman, Internal Audit Manager at First Florida Credit Union. “We were not an organization that worked remotely. Very few people even had VPN access—senior management, IT staff, and me.”

Garman explained that her institution, the $1b First Florida Credit Union based in Jacksonville, was very proactive in their response to the pandemic. In addition to quickly instituting work from home policies, they spread out departments to minimize the risk of disruption across the entire organization.

But for the audit department, they needed to worry about non-virus risks—and working from home presented challenges. “I looked at the audit plan and decided on the areas I could audit that would not impact the department.” She found areas that she could audit without being physically present, and she’s prioritizing those ahead of on-premise audits.

“Audit departments need to be flexible. And I don’t think that’s a strength that we’ve always had. But in this day and age, I truly believe that you can’t just stick to what you’ve always done. If the business changes, we have to change along with the business.”

Steve Pagenstecher, COO at Point West Credit Union, also stressed the need to adapt. They took note of the virus in early March. “Two days later… more than half of our staff was remote and has been ever since.”

Point West is a $100m credit union based in Portland, Oregon. So, protests, police, and wildfires also impacted their normal operations. But COVID-19 introduced the biggest difficulties. Whereas First Florida reordered their audit schedule, Point West found a couple of key workarounds.

“A good example would be a branch audit,” said Pagenstecher. “We recently did a surprise cash-out. We verified we had access to the cameras. And the day of, we let the branch manager know that we were going to do it; she was on-site at the branch. We had two staff members recording the cash count with the branch manager’s phone. And the whole time, our VP of Finance was watching over the security cameras.” He added, “At the end of the day, the process is still the same.”

One resource Pagenstecher mentioned was how their audit management platform kept their audit team on track during and after the work-from-home transition. “A platform like Redboard, now, more than ever, really serves a critical purpose. This whole centralized online platform to manage that audit process. I think it really does add adaptability and flexibility to an organization of any size.”

Casey McIntosh, VP of Risk at Del Norte Credit Union, found a similar approach through the chaos. “The Audit and Risk program during the pandemic has definitely been a challenge,” she said. “About half of our employees… started working from home very quickly. And that, in itself, was an issue. Just the logistics of setting up remote connections, finding laptops, printers—that was challenging.”

However, Del Norte had been pushing to digitize their processes before 2020 broke loose. “Most of our audits we were actually able to do offsite. We’re pretty much paperless when it comes to loans and accounts, and our records are almost all electronic. That made it easy to transition.”

McIntosh also suggested that workarounds were preferable to reprioritization. “When it became apparent in early summer that [the virus] wasn’t just going to go away anytime soon, we did our first cash count audit virtually.”

She mentioned that vendor relationships and technology was key to their remote work strategy. For example, Zoom enabled workarounds for traditionally in-branch audits, such as their cash count and vault audit. Redboard kept their team organized and on track through their transition to working from home.

In fact, she suspected that vendor management would take on a bigger role in future audits. She found that Del Norte was “so much more reliant on vendors and software providers for support, additional licenses,” and other needs. But the biggest changes to future audit practices involved remote work.

All three credit union representatives predicted long-term changes to audit programs and policies, especially around work from home policies. All expect remote work to continue indefinitely—at least to some extent. “I think working remotely will stick. And that’s something we have to account for when we’re looking at an audit program on the internal controls risk assessments,” noted McIntosh.

Garman and Pagenstecher also mentioned that future audits will need to cover remote work practices. Garman had more questions than solutions to start: “I would review our work from home policies now… what about bring your device to work? What type of technology do we allow on those devices? How do we make sure our networks are secure? Are we doing all our vulnerability management? Are we doing all our patching?” She asked. “I would look at those things that were never in my audit plan before,” she added.

Pagenstecher felt the same. “Credit unions who either had telework policies—or didn’t have telework policies, but do now—are paying much closer attention,” he said.

So, looking down the road, credit union audit and risk management departments must ask some big questions. What are your changes in risk control assessments? How will remote work policies affect the way your credit union completes an audit? And which tools and technology will best help you digitize those processes?