COVID-19 Work from Home Impact on EUC Internal Controls Effectiveness

Introduction

Beginning in March, shortly after the coronavirus pandemic started to sweep across the country, we needed to figure out a way to stay in touch with our LinkedIn followers as well as our own personal connections. However, what we did not want to do was be another company broadcasting the very familiar line of ‘… here at insert company name, we are going the extra mile and making add suitable number of adjectives efforts to add whatever trending #hashtag that sprang to mind.’

Instead, in early March, we began sending LinkedIn messages to our followers and connections explaining that we were interested in understanding their experience of the coronavirus impact in their work environment, business processes, and internal controls with a series of open ended questions. We continued to reach out with the same message every day since.

The message read as follows:

Fast forward three months and an extraordinary number of responses later, we thought it would be useful to share a summary of the feedback. It is, however, important to remember that the responses we received were unstructured descriptive accounts. Some responses were short, but often than not, they were detailed and provided some surprises along with some very predictable insights into how companies and their employees had been coping through this unique and still very current situation.

When we began analyzing the responses, we realized that we could only effectively/ accurately reflect those respondent’s comments, observations and conclusions across two main groupings. Those that worked in either ‘Accounting’ or ‘Financial Reporting’.

Based on specific references within each respondent’s reply we were then able to further identify discrete ‘Sentiment’ categories that were common across the majority of responses received.

1. The Transition to Working from Home
2. The Impact on Business Process Performance
3. The Effectiveness of Existing Internal Controls
4. The Respondent’s Expectations of What Lies Ahead

Read the rest of our methodology here.

What do we want to achieve?

Our goal is to engage with people in risk, audit, and/or compliance roles, from staff accountants to SVPs, who are impacted by working from home and must still meet their organization’s regulatory mandates, oversight and reporting cycles regardless of the contagion. To that end, we deliberately left the questions open-ended because we really had no idea how things were going to proceed or what kind of changes we could expect to see.

What we found

To best understand and most accurately reflect the conclusions that can be drawn from the data, we will start with an analysis of all the data gathered from both the Accounting group and the Financial Reporting group collectively. The sentiment data used for this ‘All Group’ analysis will be represented graphically with an explanation of those trends that can be surmised. Subsets of this collective dataset will then be used to affirm and expand on what is driving the high-level trending. This same approach will then be used to look at trending patterns in each group individually.

The high-level view

Across both the positive and negative sentiment graphs, it is clear that in the three and half months since the survey started, overall the negative sentiment has decreased and the positive increased. It is worth noting that the negative sentiment has decreased at a slightly faster and more consistent rate than the positive sentiment has increased.

To better understand the dynamics of what drove the increase in positive sentiment and the faster decrease in negative sentiment we will need to look at the categories in more detail.

When the combined positive and negative sentiments of ‘Internal Controls Effectiveness’ are viewed in isolation, we can see a similar trend with positive feedback increasing and negative feedback decreasing, while intersecting in May and remaining steady as we head into the end of Q2.

Next, we will combine the ‘Internal Controls Effectiveness’ sentiment with the ‘Business Process Impact’ sentiment to gain a more accurate and relevant picture. When these two sets of data are combined the line chart below shows the sentiment shift is less significant, with the positive and negatives more closely aligned.

This tighter alignment suggests that the changes in sentiment must be attributed to respondents’ experience of working from home, regardless of their sentiment on ‘Internal Controls Effectiveness’ and ‘Business Process Impact’.

The graph below showing the ‘Working from Home’ sentiment appears to support this interpretation— with a sharp decline in negative sentiment in the first month and a significant increase in positive sentiment through May and June.

It’s reasonable to infer that all respondents, despite concerns around the effectiveness of EUC related controls and business process, were becoming increasingly more comfortable with working from home and in their ability to complete their assigned tasks outside the normal office environment.

However, the inference that respondents’ sentiment of ‘Internal Controls Effectiveness’ and ‘Business Processes Impact’ being a lesser driver of sentiment change is challenged when sentiment of only senior management respondents (manager and above) are examined across the same categories and subcategories.

In this regard, when only senior management responses are analyzed, it is clear that both the positive and the negative sentiments have each declined rather than the previous examined trends of the negative declining and the positive sentiment increasing. Moreover, after intersecting in early June, the positive sentiment continued to decline even further.

Why do we find a clear difference in sentiment between senior and junior management? By further analyzing what the senior management sentiments were on the ‘Internal Controls Effectiveness’, it is evident that things have changed. By the beginning of June, only two of the 6 subcategories remain – ‘Financial Reporting Communication to Business Compromised’ and the sentiment supporting ‘Enhanced Audit/ Compliance Checks’. Moreover, the sentiment supporting ‘Enhanced Audit/ Compliance Checks’ now appears for the first time and given that this metric is a percentage of the total sentiment over the three and half months, is clearly dominating the concerns of senior managers.

The emergence in June of this dominant sentiment, ‘Enhanced Audit / Compliance Checks’ (considered a positive sentiment), is therefore significant. Why? First, its timing coincides with the decline in both positive and negative sentiment in June among all senior management respondents—which makes sense. Second, the proportion of senior management expressing this sentiment had been absent from the first 3 months of the same group of senior respondents.

Put another way, it would appear that after 3 months of working with EUCs remotely, those in senior management roles are now realizing that significant aspects of the pre-coronavirus EUC- related internal controls and compliance checks are and/ or becoming less effective. We believe these senior leaders are thinking that the controls will need to be reviewed and enhanced to manage the additional risk that has emerged over the prior 3 months of employees working with EUCs remotely.

Accounting compared to financial reporting sentiment

If we now apply the same methodology described above to examining the positive and negative sentiments of the Accounting and Financial Reporting groups independently of each other, we find similar patterns.

However, as before, differences between the two groups appear when analyzing senior management sentiment. In this analysis, recognition of the potential (or actual) ineffectiveness of EUC-related internal controls when working from home is clearly coming from the Accounting group of respondents rather than the Financial Reporting group.

To illustrate this finding, the bar charts below and their associated trend lines represent the following:

1. Overall positive and negative sentiment across all categories
2. Sentiment expressed in only the ‘Effectiveness of Internal Controls’ category

Positive and Negative Sentiment – Group Compare, All Categories and Subcategories

When the positive and negative sentiment is broken out by group, the patterns are not dissimilar to those found for both groups collectively. Interestingly, the increase in positive sentiment for the Accounting group is more conservative and linear than the Financial Reporting group. Likewise for the negative sentiment— the Accounting group initial decline is tempered by a rise in June that is not reflected in the Financial Reporting group.

Positive and Negative Sentiment – Group Compare, Internal Controls Effectiveness Category

As with the analysis of both groups collectively, drilling down into the sentiments expressed by senior management across just the ‘Internal Controls Effectiveness’, reveals the same spike that we saw earlier. However, by separating out the two groups, we’re able to identify the Accounting group’s senior management respondents as the root of concerns around the need for ‘Enhanced Audit/ Compliance Checks’. The Financial Reporting group concern with controls appears to recede in May.

Given that most of our respondents follow the typical Jan – Dec financial reporting cycles, these results would make sense. By the end of April/ beginning of May, the Q1 10Q’s will have been completed for the Financial Reporting group. Whereas for the Accounting group, Month End and Quarter End cycles would have continued on regardless— thus testing and straining existing controls to a far greater degree.

Here are the conclusions we can draw from this survey

When all respondents, at all levels of seniority, across both the Accounting and Financial Reporting, are examined and compared with each group individually— two possible conclusions can be inferred.

First, as company employees responsible for accounting and financial reporting transitioned to working from home, the majority became increasingly comfortable with the new working conditions. This is reflected with a consistent decline in negative sentiment being closely matched by a steady and significant increase in positive sentiment.

Second, when the responses from senior management were considered, decline in negative sentiment and increase in positive sentiment was not as marked. Moreover, when the ‘Working from Home’ sentiment data was removed and sentiment responses for the remaining categories and subcategories were analyzed, it was clear that the difference between positive and negative was negligible. Further, when only ‘Internal Controls Effectiveness’ was examined with each group separately— it was clear that senior management sentiment in early June had not only changed, but focused on ‘Enhanced Audit/ Compliance Checks’. That focus came only from the Accounting group respondents.

However, it is important to remember that despite these insights, this survey was limited in scope and was fundamentally subjective in nature. What is needed now, is a broader, objectively measurable survey that seeks to determine if these findings are accurate or flawed, and if flawed, in what respect.

What’s Next?

Starting on Monday July 6th and running through Friday, July 31st, Apparity will launch a formal survey, targeted by industry and function that will build on the findings of this report. It will be structured to measure the viability of working from home, the use and oversight of critical EUCs (spreadsheets, databases, and scripts such as Python and R), and the effectiveness of EUC controls.

Given that EUC applications remain at the heart of most organizations’ regulatory controls frameworks, the survey will seek to provide an objective understanding of how the user is performing and what additional audit enhancements and compliance checks companies believe will be needed (or not, as the case may be) for their regular reporting cycles to remain effective and robust during the lifetime of the coronavirus pandemic.

The survey will be deliberately concise and structured in such a way to ensure that a respondent should take no more than four minutes to complete. Upon completion, each respondent will be able to view their results as compared to the results from all respondents gathered up until that point. This results report, when based on their scoring, will be configured to provide insights that respondents should consider implementing immediately and over the near to medium term.

At the conclusion of the review, the respondent can opt-in to receive a copy of the final report due out mid-August.

Respondents and Responses Methodology

Here is how we decided to present our findings

1. We needed to ensure that all responses remained anonymous in every respect. This meant that we would not be quoting (directly or indirectly) any reply, naming any individual or any company.
2. All replies therefore had to be grouped and categorized in such a way that patterns could be established, and trends identified without compromising the source(s) in any way.
3. Because we encouraged respondents to just tell us what they ‘thought’ we want to be careful to make clear that the summary findings be considered subjective and not one that had the rigors of methodology and objective statistical assessment.
4. As a result, we decided to use the idea of ‘Sentiment’, specifically ‘Positive Sentiment’ and ‘Negative Sentiment’ to characterize our findings, with some additional metrics around the effectiveness of ‘Internal Controls’ over time, across the four categories and associated subcategories that were most commonly found in respondents replies.

Here is how we structured, grouped and categorized the responses we received

Response Structuring

At the time of compiling the responses, we received 73 responses across 12 major industry sectors from companies that we were able to classify into 5 size by revenue categories and 5 levels of seniority groupings. Below is a breakdown of those industry sectors, company size categories and respondent seniorities by a percentage of the total responses received:

Here is the Sentiment Analysis Methodology Explained

When we began analyzing the responses received over the months of March, April, May, and the first half of June, we realized that we could only effectively/ accurately reflect those respondent’s comments, observations and conclusions across two main groupings. Those that worked in either ‘Accounting’ or ‘Financial Reporting’.

Based on specific references within each respondent’s reply we were then able to further identify discrete ‘Sentiment’ categories that were common across the majority of responses received.

1. The Transition to Working from Home
2. The Impact on Business Process Performance
3. The Effectiveness of Existing Internal Controls
4. The Respondent’s Expectations of What Lies Ahead

Finally, these categories were then assigned two or more subcategories that captured the ‘Experience’ reflected in the respondent’s comments. The categories and associated ‘Experience’ subcategories are listed below:

Category: The Transition to Working from Home Subcategories (‘Experience’)

1. Positive – Seamless Transition
2. Positive – New Equipment Provided
3. Negative – Difficult Transition
4. Negative – Children at Home
5. Negative – Ill Equipped Home Office
6. Negative – Does not want to work from home
7. Negative – Longer Working Hours

Category: The Impact on Business Process Performance Subcategories (‘Experience’)

1. Negative – Snail Mail based processes no longer work
2. Negative – Paper based systems not digitized, so not accessible

Category: The Effectiveness of Existing Internal Controls Subcategories (‘Experience’)

1. Positive – Existing controls working well
2. Positive – Enhanced Audit / Compliance Checks Implemented
3. Positive – Expect Initial Problems to be Resolved
4. Negative – Inadequate Execution of Existing Internal Controls
5. Negative – Financial Reporting Data Integrity Validation Compromised
6. Negative – Financial Reporting Communication with Business Stakeholders Compromised

Category: The Respondent’s Expectations of What Lies Ahead Subcategories (‘Experience’)

1. Positive – Anticipates that working practices will be forever changed
2. Negative – Anticipates Increased Frequency of 8K filings

Each of the respondent’s description or answers to the questions posed in the LinkedIn message were therefore associated by Group (Accounting or Financial Reporting) with one or more of the categories and the relevant subcategory – thus ‘tagging’ each category/ subcategory response as either a ‘Negative’ or a ‘Positive’ experience.

Further Notes

It’s important to note that because of the subjective nature of the responses we solicited, any one response could be assigned to either just one or more than one category/ subcategory. Furthermore, the delineation of responses into categories and subcategories must also be considered a subjective exercise, albeit one based on many years of experience working within the EUC risk management space. In that respect, it should also be pointed out that 27 of the 73 responses did not get recorded and are therefore not reflected in the findings outlined below.

Of those remaining 36 responses that did get recorded with one or more counts of either a positive or negative experience (‘Sentiment’) within the 4 categories/ subcategories, we believed were sufficiently compelling to infer ‘trends’ around the scope of the impact on companies and their employees when transitioning the use and management of EUCs, particularly spreadsheets, from the office to the home environment over the last three months.