Covid-19 (coronavirus) and IT: Impact on the internal control system with regard to financial losses

published on 10 March 2020 | reading approx. time 2 minutes

It is not to be dismissed out of hand. In extreme situations, financial losses (fraudulent actions, errors in decisions, etc.) can occur. Particularly in today's world, in which the personnel capacities in companies are optimised and substitution is still regulated for holiday periods and "normal" sick leave, Covid-19 can lead to the fact that the internal control system existing in companies can no longer be effectively lived. What does this mean for the companies?

One might think that due to the distribution of tasks within a team, it is possible to work with a reduced internal control system for some time. However, one should not underestimate the consequences this can have for the company. It is a matter of decisions not being made correctly, which can cause financial damage to the company. There is also a risk that financial losses could be incurred as a result of the reduced number of employees and the reduced controls. This should be considered within the following phases:

In the following, we would like to provide valuable information on how the company should behave.

Preparatory Phase

Depending on the size of the company and its corporate culture, the internal control system, which has been defined, lived and reflected in IT, is of varying degrees of importance. Already in the preparation for a crisis, with major employee absences, it should be analysed which parts of the internal control system must be adhered to. In addition, it should be examined whether, in view of financial losses, important measures for procurements, projects, project acceptance etc. can be postponed or whether a substitute is ensured in the event of a crisis.

In concrete terms, this means in any case:

Classification of employees with regard to their activities in the internal control system;
Evaluation of partial and complete failures with regard to the defined or yet to be defined substitution and emergency plans;
Clarification of whether the control activities can be carried out remotely by the employees in case of quarantine by using IT;
Determination and integration of responsibilities with regard to these control activities in the corporate crisis team;
Determination of the occurrence of an emergency (i.e. in the event of failure also of the majority of representatives).

If the company lacks the capacity and know-how for the preparation phase or for representation, it is recommended to involve the Rödl & Partner crisis team.

If, according to definition, the emergency or crisis arises from preparations and one or more functionaries and representatives are affected, measures are initiated in line with the defined emergency plans.

Depending on the extent of the loss of functionaries and their representation, the crisis unit will have to take decisions on a case-by-case basis. These could be:

In case of quarantine cases the use of home office facilities;
Involvement of a third party as external service provider if possible;
Extend authorizations in the IT systems to the emergency representatives;
Postponement of decisions according to previously defined specifications;
Reduction of internal controls to the essential controls;
Etc.

Analysis of whether there were transactions or actions that may have exploited control gaps.
The original controls must be fully implemented again. Any controls that have been postponed must be made up for.
Withdrawal of the authorizations set up for the time of the crisis from the emergency representatives.
Determine whether the internal control system can be optimized based on the experience gained during the crisis.

Since the resources within the functionaries are usually not abundant, the question of the involvement of third parties arises. In this case it is also advisable to involve the Rödl & Partner crisis team.