Get in touch directly

Follow us on LinkedIn
Author: Mark Harrison


Over the last year the COVID-19 pandemic has spread across the world at an unparalleled pace, bringing a level of disruption and devastation that will shape a generation and define the global social and economic landscape for at least the next decade. Although impacts have varied from country to country, the world has collectively experienced a profound change and a new era of ‘never normal’ is predicted, characterised by unpredictability and fast changing shifts in cultural norms, societal values, and behaviours. So, what lessons can we take away from what we have experienced so far and what role can internal audit play?


The impacts of COVID-19 have been varied and far reaching, with repercussions for health, social, economic, and business outcomes.


There have been an extraordinary number of infections and deaths from COVID-19, however, the pandemic has also contributed to other health impacts. For example, fear of exposure to COVID-19 or lack of accessibility to medical professionals leading some to miss out on treatment for other conditions, and deteriorating mental health as a result of worsening economic conditions and social isolation.


The pandemic has caused significant social changes both through formal rules and restrictions in place, and informal changes due to social pressure or health concerns. There has been an increase in social isolation (especially for people with disability and the elderly), unemployment, and homelessness, as well as profound changes to work and schooling as many places moved to remote environments, in some cases exacerbating existing inequalities and placing increasing strain on families and communities trying to adjust to these new ways of existing together.


Through border closures, government-imposed lockdowns, health risks and fear of infection, social pressure to stay home, job losses, need for public investment etc. the virus has also contributed to significant economic changes that have shaped the last 12 months and will continue in some form for at least the next few years.


The combination of these varied health, social, and economic impacts are having a profound effect on strategy, customers, workforce, operations, finance and technology for businesses and organisations around the world, requiring fast pace and repeated adaptation.

Lessons learned

Observing successful and less successful adaptations to the pandemic, some general lessons emerge:

However, in addition to these general lessons, it is important for organisations to understand and evaluate their own pandemic response to identify important lessons that relate to their own unique circumstances. This is where internal audit can help.

Role for Internal Audit

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. With this skill set, internal auditors are well placed to conduct a post-crisis review focusing on an organisation’s pandemic response which can be a highly valuable exercise to assist the organisation to better adapt to future impacts whether pandemic related or not.

A post-crisis review would typically go through the following steps:

  1. Documentation of the response – Typically the documentation of key decisions and response features is poor – as the focus is more on survival and less on accountability and transparency. Documentation is important as it may be relied upon in future inquiries or legal matters.
  2. Technical investigation of the cause – An investigation of cause will be of greatest value if impact on the organisation is disproportionately higher than for similar or related organisations. A “root cause analysis” is an effective approach to use here.
  3. Quantification/explanation of impact – While most business leaders will be well-across the impacts of the pandemic, there will be instances where leadership is so deep in the tactical response, that they cannot see the longer-term and strategic impact. Although not a “typical” internal audit output, internal audit can add value in these circumstances through a research or issues paper to prompt discussion, or facilitation of an executive workshop.
  4. Assessment of the effectiveness of the response – This is a “typical” structured lessons learned project, which assesses the actions taken against a normative model. Assessments should be cognisant of the circumstances in which actions were made in order to be sympathetic and realistic.
  5. Enhance organisational resilience – Organisational resilience is “the ability of an organisation to anticipate, prepare for, respond and adapt to incremental change and sudden disruptions in order to survive and prosper. An engagement that brings learnings from the broader analysis of impacts on business, as well as the experiences facing the organisation, and takes both a historical perspective as well as a forward-looking perspective will have the greatest potential impact on organizational resilience.
Key challenges and better practice

For a lessons learned activity such as a post-crisis review to be effective, an organisation should consider the following factors:

A normative model of better practice crisis response

The following key principles can be used to guide a post-crisis review of an organisations performance in response to the pandemic (or any other crisis).

Depending on resourcing and capability, a post-crisis review could be conducted internally or through engagement with an external provider. Sententia Consulting has capability and experience in this area and would be happy to assist your organisation. Contact us to find out how we can help you today.