What we learnt – a masterclass in virtual audits

2020 THE YEAR THE AUDITS WENT VIRTUAL

Many CFOs have had to carry out their scheduled audits virtually when the Covid-19 pandemic forced everyone to work from home. These are some of the lessons they’ve learnt. By Kate Thompson Davy

There’s a famous quote attributed to US businessman Norman Ralph Augustine about the reach of auditors. He reportedly said: “Twothirds of the Earth's surface is covered with water. The other third is covered with auditors from headquarters”. And while Augustine might have been poking fun, in 2020 auditors were in the air, in the wires, and in their homes all at once. Here, in discussion with CFO South Africa, six top financial and audit professionals walk us through their shift to virtual and remote audits in 2020.

Into the rural areas

Nico Esterhuizen is the global CFO of humanitarian and development organisation Joint Aid Management (JAM) International. He told us “a virtual audit is no joke and tough on resources!” Even in a normal year (AKA not 2020), he explains, the nature of their operations makes for difficult audit processes. He says: “Our key operations are in some of the most rural areas in Africa. Although we have a country office in each programme country (with at least one finance manager) our actual operations happen in areas such as refugee camps. For example, in Uganda, we operate in the Imvepi Refugee Settlement. Given this, source documents often originate at these camps or settlements. This means to track and to get hold of these documents is difficult.”

They usually fly the source documents back to the country office, where they would be stored at warehouses, and scan them for virtual storage in a central database, he explains. “If we have access to reliable internet at any of the camps or settlements, we use flatbed scanners to upload source documents to a central database for our global support office, based in Johannesburg, to review while the original source documents make their way to the country office.” Covid-19 flight restrictions, thus, introduced a whole

new set of challenges in getting original docs to where they needed to be. “Furthermore, as our auditors, based in Mauritius, cannot travel either they have placed additional requirements on us as part of the audit standards requirements, including appropriateness and sufficiency. Our teams are working much harder due to the volume of audit queries, while grappling with the travel and lockdown restrictions.”

He continues: “We also had positive Covid-19 cases at some of our offices, which meant we had to postpone the audit for a short while, but fortunately, we have been using cloud-based email and other similar solutions for a while so we are able to work remotely, internet connection permitting.” To mitigate some of the challenges, JAM appointed additional temporary accountants, bookkeepers and admin officers on site, to assist with scanning, uploading, and filing documentation, plus “a team to review the scanned documents in terms of completeness and readability, which are then placed in a central repository which our external auditors access". The shift to these processes has also meant an uptick in communications. Nico says they now have weekly to daily meetings with the auditors to report on progress and plans. Thankfully, at the time of interview, they’d managed to get most of the audited financial statements for the various JAM entities signed off, and the others are making good progress. Also on the JAM International team is Christian Campbell. Chris is the GM for Finance, and adds that the audit firm carrying out the current exercise is a new firm, appointed by JAM in 2019. He explains that the intention at that time was to partner with auditors who could navigate the complexities of virtual audits, as well as being knowledgeable about the industry as a whole.

“They have to do walkthroughs and testing of controls in place to be able to determine the suitability and operating effectiveness of the controls during the period under review. To be able to rely on the evidence obtained, the auditors must be comfortable that the audit evidence is complete and accurate. This is a daunting task for both the auditors and us as the client,” he says. To Chris’s mind, the biggest challenge for the global support office was “to connect with the team members in the different branch offices who have various other day-to-day activities which sometimes interfere with the planned audit activities, and – moreover – to keep them engaged, positive and productive.” To keep staff motivated, Chris says, they made sure to

Nico Esterhuizen

have team leaders on site, and to create an environment where staff felt comfortable expressing their concerns. Staff efforts needed to be acknowledged openly and regularly, and they took care to connect with people about their welfare beyond the work tasks at hand. Plus, Chris says, just providing some much-needed snacks and refreshments from time to time helped. He adds: “I just want to echo that the virtual auditing has indeed been very challenging, but it has been a growth process for the team. Interestingly, despite the challenges, the audit is going smoothly and team members are in high spirits. This is, he argues, because of constructive teamwork and regular weekly meetings with JAM leaders like Nico and others.

Hitting the ground running

Ashley Francis is the former executive director for finance at the University of Cape Town (UCT). In September 2020 he took up the role of CEO of Safricang Group. He spoke to CFO South Africa before the move, having just completed a virtual audit for the university. His team hit the ground running in March when the lockdowns kicked off. Luckily, Ashley says, they did not require any new software. Instead, they focused on an efficient collaboration with their audit firm, EY.

“We amplified our regular meetings with the auditors, made a list of all the outstanding matters, determined how and when the outstanding matters would be resolved, and communicated with all affected parties with specific instructions and deadlines. Efficiency, commitment, professionalism, dedication and role clarity were paramount,” Ashley says. Ashley says his was an oversight role in the process, having already empowered his team members to execute against their KPAs. It fit with his existing leadership style. And the results? “We received an unqualified audit report in keeping with prior years. We also received compliments and accolades for improvement in certain areas. Our results were released on 30 June and were among the best results in many years, with the strongest balance sheet ever in the history of UCT." Having a shared service centre for finance was instrumental in their success, as it allowed for things like working from home, remote audits, and a paperless environment.

While the reporting wasn’t difficult, forecasting in uncertain times was a little more problematic, he says. “It’s the uncertainty of the future that impacts me the most.” Still, Ashley says was proud of the strength of their financial structure and cash availability. The process taught him that anything is possible, and “that change is inevitable and not a train smash,” he says. Plus, “our shared services initiative was spot on and timeous.”

UCT’s new executive director of finance, Hardy Maritz, says that the “Overriding things we did were constant communication with our teams and our audit team. We were also fortunate to have an audit management team who knew us and our business well, and some of them had also had to work remotely with us through student protests in the past.” “‘Fees must fall’ and student protests taught us how to work flexibly and remotely. In fact, in 2016/7 Ashley and I made the call to move our entire finance team to

“If you picture a bowl full of marbles, this tool lets us slice and dice these, organise them into different categories, spin them around, and through that you begin to see the outliers, the anomalies.”

“We did face a few challenges as it was a new process to lots of the people involved.”

laptops … This also paid dividends in moving off-site this time around as we did not have to start swapping out computers.” He continues: “Additionally, as Ashley has said, we have always empowered our team leads to do what they have to in order to get the job done. If they need help, insight or resources, let us know what you need, but getting it done rests with you. So the role we play is to mentor, support and develop our [reporting] lines while giving them the space to be creative and do what they do best.”

He concludes: “But it was very clearly a two-way street – great team on our end and a great team on EY’s end too.”

Trevor Mvundura

Mirroring the in-person audit processes

Trevor Mvundura is the CFO at TB and HIV Investigative Network (Think), a non-profit non-governmental organisation located in Durban, South Africa. As an NGO, he explains, they manage international funding from several other organisations including USAid, MSF (Doctors Without Borders), Janssen Pharmaceuticals, CDC, and Global Fund.

“We normally have funder audits on top of our normal external audits. So, during the lockdown, we did a lot of funders audits and reviews, and we are busy with external audits which are also virtual. We did manage to complete all our funders audits and verification. Our external audit did take an extra few months to complete, because we refined some of our internal reporting process. Working virtually meant we were able to revisit all our virtual processes and systems, and took time to improve them. The auditors presented the audit report virtually to the board, and they reported that it was a success with no audit findings, but they did recommend our technology advance as an organisation.” The first step, he says, was “to establish a reliable communication channel and platform as some of the auditors are based in the USA and Europe. Think uses Microsoft Sharepoint, Teams, Outlook, Planner etc, and we had to ensure that our auditors are on the system with us to ease the sharing of information and communication.” As an NGO, Think had received a donation from Microsoft of the complete Microsoft 365 software suite and platforms. “So, when Covid came, the whole organisation was already working online.” Teams was their primary comms tool, and they set up a group to include all accounting officers, auditors, and project managers. “Then we created a Sharepoint access where all documents required for verification were loaded and could be accessed by the team instantly.” Upfront they also had to establish “standard procedures and controls to ensure we have guidelines during the process”. “It was a bit hard considering we did not have any information or process done before to base it on. In the past, they always came to SA and spent a few weeks reviewing everything. So, to make it easy and seamless, we kind of mirrored what we would do if they were around physically, including granting guest access to all our finance software and the organisation’s Sharepoint (with limited access).” Spending the time upfront for proper setup was essential, he says. “If this part is not done properly by all parties then it will be hard to go through the audit as it addresses the communication, access of information and also meeting times and time difference. Preparation for a virtual or remote audit is key to a successful outcome.”

They also had to take care to meet all local and global data privacy requirements, and establish a method on how records would be “pulled” and shared.

Riaan Koppeschaar

“The virtual auditing has indeed been very challenging, but it has been a growth process for the team.”

“It is understood that confidentiality and controlled distribution of documents is a concern for the audit firm, so file sharing with read-only access is important.” In addition to setting up meetings and linking in all the appropriate staff for the audit, they had to set up a virtual tour of facilities and sites. This is all included in the audit plan and agenda. “A risk-based assessment should also be applied to define the needs of the facilities tour, including which areas are essential if a complete tour is not feasible,” Trevor says. Only after all of that can the audit process properly start. As CFO, Trevor not only got involved in drafting the standard operating procedure (SOP) for the audit, but also in determining the training the team needed and in internal control. “After my finance managers got the hang of it, it was easy to liaise with auditors to get information through and have channels to communicate with them easily. These included sometimes sharing screens on Team’s chat to ensure the whole team understands. It was easy for me to be involved as I feel that technology can make all these tedious processes easy, and I am a fan of a paperless audit and finance departments.” The end results were a success despite the challenges, Trevor says. “We did face a few challenges as it was a new process to lots of the people involved.” And loadshedding and managing time differences didn’t help matters. “Now that we have started on the [virtual audit] process, I don’t see why we should stop going forward. We could improve in streamlining the process, and also learn from others. I see future audits done virtually across the whole world.”

Quite a standard virtual audit

Exxaro’s CFO Riaan Koppeschaar takes us through a full rundown of their extraordinary audit on page 48. In addition, he explains their process here, saying: “The review of the interim results was performed virtually by our external auditors. There were no contact sessions with the auditors, only virtually meetings that were held (using Microsoft Teams). Detailed planning and due dates were communicated before the review started.”

“Our auditors implemented a virtual platform to which all deliverables to the auditors were uploaded. This was visible to the full audit team, as well as the Exxaro reporting team. The auditors also had access to our systems to extract data as required.” Although this was a virtual review, he says the process was “quite standard”. “The main changes were instead of the face-to-face interaction, we used Microsoft Teams to discuss accounting matters and, secondly, the required documents were uploaded onto a secure system implemented by the auditors.” Riaan calls the review a success, and sings the praises of the internal team and audit team who worked together to “resolve matters timeously” and were “very innovative and proactive in planning for the virtual review”. This, he says, also broadened their IT skills and knowledge. “All reviews and approvals were done electronically, including the audit committee and the board meeting to approve the interim results,” he says, and “we will definitely continue using technology to enhance the way we do our reporting.”

What the auditors had to do

On the audit side, Natalie Terblanche is a partner at

PwC and director of audit technical and methodology at PwC. Her team has been beating the virtual audits and technological transformation drum – so to speak – for a while, and believe firmly in the benefits (like transparency and efficiency) that it can offer. Despite this, she isn’t a “techie”. “What I am able to do is take difficult concepts and make them accessible to everyone. One of the tasks that I have is showing staff that technology doesn’t mean coding or inventing artificial intelligence. It means doing pretty much what we’re doing here today – engaging using a technology platform – and experiencing enhanced efficiency because of it. I would say I’m an advocate of efficiency.” Among the tools she rates are those that can be used to store, encrypt and authenticate data. PwC started introducing clients to new tools over the past decade, starting with Aura, which is their audit software. In the intervening years, they’ve released several interactive and digital tools, including PwC Connect, which is a collaboration tool. In addition to encryption, it offers dashboarding. Then there is Halo, which Natalie describes as “data analytics on steroids”. “It helps us to look at all transactions from different angles. If you picture a bowl full of marbles, this tool lets us slice and dice these, organise them into different categories, spin them around, and through that you begin to see the outliers, the anomalies.” PwC’s own digital adoption is advanced, which helped them make the changes they needed to make internally during lockdown too, Natalie explains. They had long since removed phones in favour of VoiP calls, and equipped staff with the devices they needed to be mobile and connected. “What we were less prepared for is how you might coach someone if you have less face-to-face contact, how you support them in this time of massive external and internal pressures while still meeting the deliverables. “Between March and now, we have definitely changed subtle things. We have found really great ways of collaborating and using time more efficiently, ways of making sure that our clients also know where we are, when we are expected to be on site. And balancing that expectation – now that we're on the level one alert [at the time of interview] and can be on site – when it makes better sense for us to be working remotely without the disruptions the office introduces,” she says. PwC, and Natalie’s team, have also been proactively liaising with legal teams to keep staff up to date on pertinent digital debates and shifting best practice – things like unpacking the difference between electronic versus digital signatures, and understanding when one or the other is appropriate and acceptable. In her experience, Natalie says, most clients were ready and willing to make the necessary shifts. Some had more questions than others, but generally speaking she found it was often the IT team on the client side (rather than the finance team) who needed the most information and reassurance regarding privacy and encryption, for example. On the more advanced end of the scale, the global PwC network is also using tools like drones for remote site and stockpile inspection, and the use of data analysis to flag things like fraud and irregularities. Natalie is personally quite excited about the potential of tools that enhance data extraction or harnessing. She says: “If you ask me, in the next five to ten years, data and harnessing data, sifting through that data, is going to become critical to the success of any business, as well as making sure that they can protect that data, store that data and understand what that data is telling them in order to make sound business decisions.”

If she was advising a client early in their digital transformation journey, Natalie says, she’d encourage them to invest in future-ready cloud storage: it’s a risk mitigation strategy that can also unlock value. Choose your cloud storage for the future, she advises, not for your current requirements. l

Natalie Terblanche