Carrying on as if nothing has changed makes no sense to me.
We should be asking “how can we help?”
The answer for risk practitioners should be clear: work with management to ensure that the organization is prepared and capable of responding promptly and appropriately to:
- A breakdown in the supply of materials
- An inability to deliver products or services to customers
- The forced closure of a part of the business, such as a factory or a call center
- The loss of key personnel who come down with symptoms
- The inability of a competitor to deliver products or services (an opportunity!)
- A surge or drop in demand
- …and so on
It may not be as easy for internal audit to know its place today, even for the next months.
But carrying on as normal is unacceptable.
What was identified as the top risk when you did your audit planning and risk assessment, what you are auditing as your read this, is almost certainly not the top risk today.
So set your audit plan aside.
How can we help management (and the board, but less directly)?
For example, when I was CAE, members of my staff were part of the crisis response team. Some:
- … stepped into temporary operations roles to supplement the management team
- … helped with the communications process, calling members of the emergency response team
- … acted as secretaries and…
