ThinkTWENTY20

by Donald E Sheehy

With this global pandemic many companies have been forced to close offices and run operations remotely. COVID-19 health and safety measures recently implemented in countries across the globe are likely to impact the way in which a practitioner plans and performs their procedures to support a SOC opinion, especially where data centers are involved.   The issue- can the practitioner and client be onsite in order that the practitioner can obtain sufficient appropriate evidence 

As a result of restricted/limited access to a CA’s physical premises and CA management, the completion of necessary procedures required to assess whether certain key controls are designed and operating effectively may be more challenging. In some cases, the practitioner may be able to perform alternative procedures to evaluate the effectiveness of controls.  

In addition, health and safety measures may also create a scenario where the data center not be able to perform (or appropriately perform) certain controls that are set out in the SCO report, In the absence of suitable compensating controls, this non-performance or deficiencies in the operating effectiveness of controls could result in a qualified (or adverse) opinion. 

The AICPA and CPA Canada have developed non-authoritative guidance for potentially dealing with this issue.   AICPA guidance  FAQs — SOC 1® and SOC 2® Issues Arising From COVID‐19 is located at https://www.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/faq-soc-engagements-coronavirus.pdf

 CPA Canada issued guidance, adapting the AICPA guidance at https://www.cpacanada.ca/en/business-and-accounting-resources/financial-and-non-financial-reporting/mdanda-and-other-financial-reporting/publications/covid-19-external-auditing-reporting-resources/covid-19-key-audit-considerations-resources

Both cover these areas:

• Understanding Changes to a Service Organization’s Operations, Systems and System Controls due to COVID-19 - What are important considerations for service auditors planning their SOC engagements in 2020?
• COVID-19-Related Disclosures in the Description of the Service Organization’s System - Is the description of the system required to include disclosures about the effect of COVID-19 on the service organization?
• Performing Procedures Remotely- What matters may service auditors consider when determining whether they can perform a SOC engagement remotely?

• Going Concern Issues - Do service auditors have any responsibility in SOC engagements for going concern issues of the service organization arising from COVID-19?
• Subsequent Events- Should service auditors consider the need for subsequent events disclosures related to COVID-19 in SOC engagements?
• Management Representation Letters- Should service auditors request additional representations related to COVID-19 in the management representation letter?
• Subservice Organizations - How might COVID-19 affect a service organization’s disclosures surrounding the use of subservice organizations?

This is just a subset of COVID-19 resources that are available from the Institutes that are available to assist practitioners.

The European Commission (EC) announced in July 2020 that the European Financial Reporting Advisory Group (EFRAG) is to develop recommendations for non-financial reporting standards. It is envisaged that non-financial reporting standards will include elements of what is normally referred to as ESG reporting.

As set out earlier in the year, the EC is taking an in-depth look at non-financial reporting, including reviewing the Non-Financial Reporting Directive (NFRD). Under that directive, large companies have to publish reports on the policies they implement in relation to environmental protection, social responsibility and treatment of employees, respect for human rights, anti-corruption and bribery, and diversity on company boards (in terms of age, gender, educational and professional background).

EFRAG will mobilise a balanced and broad task force, taking into account a wide range of stakeholders and expertise, to prepare technical advice. The recommendations must build on existing standards and frameworks, and will be developed in close association with existing standard setting organisations.

We all know that the post-covid world will be different than it was before. What we don’t know exactly is how different, or precisely what the changes will be. Some of the changes in behaviour will last. Others not. Some will lead to further changes.

Jim Carroll gives us some facts to ponder:

• “you won’t be going to a conference, event, or corporate off-site for a long, long time
• even so, you don’t like the virtual events you’ve been to so far – they’re pretty bad, too long, are boring and often devoid of content
• and yet, organizations and associations have a crushing, relentless need to bring their people, teams and members together in the relentless pursuit of new knowledge and new connections.”

For more on these views, check out this website. https://jimcarroll.com/2020/07/daily-inspiration-right-now-your-speed-matters-more-than-your-plan-think-fast-move-faster/

Clearly there is some reconciliation needed here. And further changes will be needed to accomplish this. And there is not much time to adapt. As Jim says,” act fast.”

There is an excellent series going on CNBC at http://www.cnbc.com/interrupted which will help businesses with finding a focus of the change they need. It could be better, faster online service, changing products, streamlining supply chains, or something else.

There is no one change that will fit all businesses. But change is needed, And fast!