Maintaining Strong Internal Controls During the Coronavirus Pandemic

As the COVID-19 pandemic grows, we’ve begun receiving questions from our clients on how to best handle the many disruptions. To help broadly respond to the situation, we’ve decided to publish our responses and recommendations here. So far, the impacts we’re seeing in and out of Washington state include cancellation of events, declining investment portfolios, and employees having to work from home, either for safety reasons or to care for children not in school.

While working from home is recommended by authorities for containing the outbreak, employees remoting in creates challenges when following internal control policies and ensuring proper segregation of duties.

Given all of this, some best practice recommendations to consider include:

Accounting Policies and Procedures

• As a Certified Fraud Examiner (CFE), I highly recommend calling an email requester before wiring funds, sending a check, sending sensitive information, changing direct deposit accounts, or updating system settings. Unfortunately, fraudsters will see the coronavirus as an opportunity to push out phishing and spear phishing attacks on organizations.
• Consider how all your approval processes will change for areas in which you aren’t currently using an online approval process.
• Diligently check online banking at least weekly, if not daily, since segregation of duties is harder to accomplish.
• Make sure you understand your business disruption insurance to see if it might provide coverage during this time for lost revenue or canceled events. Call your insurance advisor if you are unsure of your coverage.
• Consider checking with your investment advisor regarding your investment portfolio and any recommendations they might have given the recent significant declines.
• For those with loans, you may need to start talking with your lender about waiving possible loan covenant violations. Some organizations have canceled events or experienced major declines that could cause them to fail a financial ratio covenant. Other businesses may be required to submit audited financials by a certain date, something that may be difficult to achieve if your staff or the audit firm’s staff are experiencing setbacks from the pandemic.
• For those with grants or contracts that have periods of availability specified in them, you may want to reach out to the funders and negotiate a longer period of availability if your capacity to execute on the agreement is limited during this time.
• Payroll is typically an organization’s largest expense. Whether you do it yourself or outsource the responsibility, develop a plan for processing and approvals in a remote environment.
• For those hosting paid events such as performances or conferences, consider whether you will refund those prepaid amounts, offer credit, or plan to reschedule the event. If you’re a not-for-profit, you might also approach the payor and ask if they’d be willing to consider the payment a contribution, in lieu of a refund.

IT Policies and Procedures

With regard to your IT systems, while employees are working remotely you should consider:

• Multi-factor authentication for all external access (especially email) no matter the situation. It may be easier for organizations to implement this now since they can use the change in work environments as a trigger.
• If you are in the healthcare sector, remember that HIPAA requirements still apply, so you need to ensure the security of that information on employee home computers as well.
• Data and remote access policies are another item of concern as more people work from home, especially if they are using a personal computer to access company resources. It’s important to address these questions:
  • If employees don’t have laptops, do you allow employees to work from their own computer?
  • What is the policy for accessing company data/resources (e.g. cloud services) from a personal computer?
  • Are there policies around (not) storing company data on personal computers?

Federal Taxes

One final consideration is federal tax requirements.

• Tax forms are required to be signed by specific individuals in your organization. Take that into consideration early and have a plan to get needed approvals.
• Currently, the federal government is considering legislation to:
  • Extend due dates for tax returns for individuals. The concern is that, with IRS and paid preparer staffing limitations, individuals may be challenged in meeting the filing deadline. That leaves us wondering about not-for-profits on final extension with a May 15^th deadline. Will they also be extended? And what about estimated tax payments on unrelated business income?
  • Reduce payroll taxes (Social Security and Medicare)
  • Provide industry loans to sectors hit hardest by the outbreak. Not-for-profit groups are lobbying hard to get themselves included in this legislation.

Things are moving quickly in D.C., we will keep you posted on updates to the developing situation.

Conclusion

If you have any questions regarding the recommendations, please contact the appropriate advisor. We are in uncharted waters now, so please call us if you have questions.