Advisories & Insights

Risk Management Article COVID-19

April, 2020
By Wilhelm Dingler

Remaining vigilant regarding risk management is of prime importance in these uncertain times. While the COVID-19 virus may be disrupting the typical "to do" list, the work must still get done. We offer some thoughts to help you to remain focused on providing outstanding service(s) for your clients as well as to continue to maintain proper risk management techniques and processes.

Client(s) and Communication

Like you, these times are unsettling for your clients. This is particularly true given the rollercoaster stock market, changes in the tax law, and the new legislation designed to deal with the financial impacts of COVID-19. Expect an increase in ‘traffic' to your e-mail, website, and phones. Make sure your website is robust enough to handle an increase in traffic. So, too, you should be prepared for increased telephone call volume. With many people working remotely, be sure you have addressed how telephone calls will be answered and routed to the proper person. Test run your scenarios to be sure you have a solid system in place. Equally important is e-mail monitoring. Since the assumption is that people are working remotely, the expectation is that you will be ultra-responsive to an e-mail. Consider an automatic reply to e-mails outlining, briefly, your situation and when the client might realistically expect a response.

Plan Monitoring

Whatever plan(s) you implement, be sure to stay on top of it. As circumstances change, you should be mindful of the need to modify or tweak your plan(s). For example, you may develop a plan to have all telephone calls routed through a central exchange with an automated message allowing the caller to be transferred to the person to whom they wish to speak. To monitor your plan, be sure to periodically call that number yourself to verify that it is still working correctly. With respect to specific work product you produce, you should have extra redundancies built in for follow-up. For example, create a firm-wide reminder list. Make the list accessible to all and be sure that any deliverable is notated on the list and the person responsible for follow-up and deadlines clearly identified. If you learn that the person responsible for follow-up cannot perform, you can easily visualize what was on that person's plate and reallocate resources to timely meet the client's needs. Remember, you are not all in the office, you cannot simply walk into someone's office to see what is on their desk. This system replicates that electronically and is visible to all.

Remote Connectivity

It is important to secure your client's sensitive data. This has always been the case. Now, however, with the increase in remote working, it is imperative that you and your personnel have safe and secure systems in place. Moreover, statistics show that hackers and phishers have increased their nefarious activity. Vigilance and robust security for remote workers is paramount. Consider two-factor identification for remote sign-in. Where possible, have people log in through secure VPN or other networks of a secure nature. Avoid free or public networks as they do not screen and are typically not secure. Also, we still use paper. Remember, you are not at the office where the secure shredding bin is located. Be sure to segregate items destined for the shredder and not put them in your home trash or recycling bins. Again, thieves and hackers are not averse to rooting through your bins at the curb. Keep a separate bag/box/hopper for the "to be shredded" and hold onto them until you go back to the office. This policy should be published for your staff and adhered to by you and them. Finally, original source documents are likely scanned and the hard copy has already been, or will be, returned to the client. Now that your entire firm is remote, an increase in potential cyber-theft of those documents increases. While we do not recommend specific software/hardware/systems, we believe that mere recognition of the increase for theft will cause you to evaluate your cyber footprint and access to your client's data.

Personnel

You know the personnel you have or may need to meet your client obligations. While increasing personnel is likely not high on the lists of most businesspeople in these times, it may be that you will need additional staff to meet client expectations when the office is virtual. As noted above, it is likely you will see an increase in electronic and telephonic traffic. Not only do you need to be sure your systems can respond to the increase, but also that you have enough boots on the virtual ground to meet the increase. If you want to have your telephones answered by a live person, you might consider a second, overflow, receptionist. That can be an addition to staff or it can be accomplished by task-sharing amongst current staff. The definition of "essential services" can be different depending upon your location. To the extent your services qualify as an essential service in your jurisdiction, and you are permitted under the COVID-19 social distancing rules of your state and further assuming you can perform certain attest functions, it can be a challenge when it comes to fieldwork while maintaining "social distancing." To the extent you are allowed to visit a client, advanced preparation is advisable so that the minimal amount of persons necessary to conduct field work are present and that you all keep the requisite distance from each other. It can be done, but you must do advanced planning to accomplish your goals. You might also consider conducting fieldwork virtually by having an employee of the client video or live feed the inventory to be counted. The first order of business is to make sure you are legally able to perform these services. If in doubt, don't.  

These suggestions merely scratch the surface, but what we have learned is that forewarned is forearmed. Now that you are alerted to some of the unique challenges presented by the COVID-19 pandemic and directives and responses thereto, you are in a better position to think ‘risk management' for every action needed to meet client needs while keeping oneself safe and healthy.