No matter which methodology is chosen, accounting teams should use reasoned, thoughtful, and well-documented judgments. Doing so will position accounting teams to demonstrate controls related to key estimates and reserves continue to operate effectively, despite the turbulent economic and business environment.

IT control implications

The abrupt shift from an office to remote work environment gave rise to many IT-related challenges. Virtual private networks were stretched to their breaking point, new collaboration tools rushed into production, and (due to reallocation of task ownership) system access distributed to individuals who may not have historically required it. Further, rapidly deploying these types of changes in a short period of time may have strained IT resources, including delays to routine IT activities such as security patches or updates. As a result, cybersecurity risks increased as business activities entered employees’ home networks outside of carefully curated information security protocols.

While these activities were necessary to ensure business continuity during a period of great uncertainty, organizations must properly evaluate these changes to ensure risks are adequately addressed. Proper IT and change management controls should address effective system operations, appropriate access, segregation of duties and cybersecurity.

Management teams should acknowledge that historic IT controls may not have been appropriately designed to address the risks such changes pose to the organization. Ideally, a review of design effectiveness of new or changed processes should take place in real time. However, retrospective reviews of appropriate access and segregation of duties as a result of changes to processes and roles, and a refresh of cybersecurity risks have value.

For identified issues, management should identify the compensating controls and processes in place to mitigate the impact of the deficiencies. Managers can also thoroughly investigate whether any problems with access or segregation of duties may have resulted in any improper journal entries that impact the financials. Although this review will not reduce the potential magnitude of a misstatement for control evaluation purposes, this analysis will serve as part of management’s more fulsome response to the control deficiency. It will also help external auditors to perform independent evaluations.

Maintaining business continuity despite the enormity of challenges presented by the pandemic is no easy feat. While no one could have foreseen COVID-19 or its impact on the world, a careful retrospective assessment of these areas can guide accounting organizations to respond appropriately, mitigate the impact of any issues, and proactively provide external auditors the right information to ensure a smooth year-end audit.