Public companies reporting on Internal Controls over Financial Reporting (ICFR) in their quarterly and annual financial statements must consider the impact of COVID-19 on their ICFR/Sarbanes-Oxley (SOX) functions.
The pandemic’s impact will vary from company to company based on several considerations, including information technology (IT) infrastructure, industry, locations and existing financial process maturity. Some of the changes to an ICFR function may include the modification of existing controls and/or implementation of new controls that may not have existed previously. Almost all companies will need to review their internal control documentation, including their risk and control matrices, flowcharts, testing scripts, etc., based on changes in their processes. Companies must also consider the nature, timing and extent of how the function operates. A prime example of how the changes have been brought about by COVID-19 is evidenced in controls over the existence assertion of inventory. At the time of writing, most of the U.S. is operating under a stay-at-home order. Therefore, the question for many is: How will the control executer review a cycle count or wall-to-wall physical and complete the control activity remotely? We have heard anecdotal stories of companies using technologies such as FaceTime and recordings to evidence the performance of the physical inventory controls.
Following are some thoughts and example of areas likely to be impacted and how. These are intended for discussion and do not address items such as “completeness and accuracy,” which are considered implicit in all internal controls.