Strengthening Internal Control in the COVID-19 Environment

Due to its mission-driven purpose, a nonprofit organization’s financial and operational sustainability is significantly impacted by its environment. Natural disasters, economic slowdowns and unforeseen events are just a few factors that can adversely affect nonprofit organizations. That is why a strong internal control system has always been a priority for audit committees and management of nonprofit organizations. Successful organizations have established policies to address the primary question: “what could go wrong?” Now nonprofits are facing the many challenges of dealing with the results of the global COVID-19 pandemic, which often include a scattered and remote workforce. Complicating matters further, what was once intended to be temporary work from home conditions are in many locations continuing into the fall, meaning taking a “wait and see” approach may no longer be an option.

As a result, nonprofit management teams are asking themselves if the internal controls that were once effective are still operating in a manner to achieve their objectives in this unprecedented time. How can nonprofits adapt to this remote environment, when their employees, resources, technology and documentation may only be accessible through virtual means?

Here are five tips that nonprofit management teams should consider to strengthen their internal control system in response to a remote environment:

1. Reevaluate risks. Due to the ever-changing environment the pandemic has created, prior to reassessing internal control systems, risks must first be reevaluated. Every nonprofit organization’s circumstances related to COVID-19 will be unique. Additional risks that impact the organization’s financial position may arise. Audit committees and management should ask themselves questions like:

• How has COVID-19 impacted the organization’s liquidity and capital resources?

• Is there now uncertainty about our ability to meet the covenants of our debt agreements?

• Have new cybersecurity and data integrity risks resulted from our digital working environment?

• Does our business continuity plan need to be reassessed?

Developing plans and strategies to address these questions and others is crucial to help navigate this new reality.

2. Reassess the existing control environment in response to reevaluated risks. Although a nonprofit organization may periodically reassess and test its internal control system to ensure it is working properly, we have now entered an unprecedented time, where reassessing controls takes on a whole new meaning. What proved successful in the past may now result in control gaps when taking into consideration new risks, such as a remote work environment, digital reviews/approvals and virtual documentation. Internal controls should be reassessed to determine if current existing controls are in fact targeting the specific risks now at hand.
 
Nonprofit organizations may have to make changes in order to use the information and resources available to them at this time. This could result in changes in both operational and financial policies and implementing new policies. Roles and responsibilities may have to be adjusted. Contingency plans may have to be formulated in response to the new risks that have arisen. For many nonprofit organizations, controls around donor-restricted and government grant funds may need to be enhanced. Current system capabilities may have to be explored to determine if there is the potential to automate controls. The overall implementation of amended controls is essential to thriving in this changing work environment.

3. Strengthen segregation of duties. Segregation of duties is often a challenge for nonprofit organizations, depending on their size and complexity—the smaller the size, the bigger the challenge. This challenge intensifies even more in the COVID-19 environment, where the separation of duties, which may have been enforced before, now appears less pragmatic when parties are working remotely, and circumstances are constantly changing. Questions such as “who is establishing the controls and who is monitoring them?” need to be revisited.
 
For instance, in a virtual environment, is management able to clearly distinguish between who holds physical custody of an asset versus who does record keeping for that asset? Furthermore, who has the authorization to approve transactions? Leveraging technology to enhance controls is one way to assist in clearly distinguishing between roles and responsibilities. Technology can provide collaboration tools and additional layers of approval that can help ensure that controls are enforced, and appropriate segregation of duties is maintained.

4. Document key areas. Key areas of a financial statement, especially those of higher-risk require comprehensive and robust supporting documentation. Management of nonprofit organizations should exercise extreme caution in ensuring areas such as management estimates and expenditure/cost tracking are thoroughly supported by documentation. The expectation of well-documented management estimates has always existed—however, in this rapidly changing environment, reasons and explanations of how an estimate is being recorded are more imperative than ever.

Estimations should include written assessments of the thought process behind the reported amount, as well as reasons for any changes from prior years. This is especially important when considering the impact of COVID-19 on goodwill impairment, growing concern evaluation and any potential additional debt requirements. These represent areas that likely need renewed consideration and reinforcement when documenting underlying rationales behind the estimates.
 
Additionally, proper expenditure/cost tracking has become increasingly important. Whether nonprofit organizations are incurring expenditures specific to COVID-19-related costs or receiving government relief funds, the methodology behind identifying and tracking these revenues and expenses is vital to a nonprofit organization’s financial position. A nonprofit may consider recording COVID-19-related funds received and expenses incurred in separate cost centers. Detailed supporting documentation needs to be maintained to support these amounts.

5. Don’t be afraid to seek assistance from outside experts. In order to perform their oversight function, audit committees, boards of directors and management of nonprofit organizations might need assurance that the new information and data they are processing is of the utmost quality. As new matters arise, outside experts can help the organization better understand best practices as well as help to monitor and assess the effectiveness of internal controls. They can also address complex accounting and auditing questions or assist with reviewing controls related to cybersecurity and privacy risks. External experts can also identify opportunities for nonprofit organizations by helping them understand the eligibility provisions for additional relief funding, including the Main Street Lending program. Templates and tools can be provided to the organization to help them better understand the calculations behind the relief packages available to them.

No matter what stage a nonprofit organization is in with its response to COVID-19, it’s imperative to maintain internal control systems to adapt to the continuously changing environment and sustain its mission critical work.

Be sure to keep up with the latest happenings in the nonprofit industry by subscribing to our blog, and following us on Twitter @BDONonprofit.