Every day brings new developments regarding the novel coronavirus as the crisis worsens and reaches pandemic proportions. No doubt, it has been a major topic of discussion behind closed doors in audit committee meetings over the past several weeks.
Risk managers must address coronavirus head-on in their financial reporting and risk management processes and must disclose any potential business risks within their public filings. The time is now to update your company’s financial reporting, risk assessment and disclosure practices to account for this disease.
Follow this step-by-step guide to navigating risk management during the coronavirus crisis.
Step 1: Update your risk assessment
Companies should routinely update their risk assessments, financial reporting, and disclosure procedures and policies, but with the quickly evolving coronavirus situation, time is of the essence. To create a comprehensive risk assessment that will inform your risk management approach, ask yourself the following questions:
- Do we have operations, personnel, third-party service providers, customers, manufacturers or suppliers in areas significantly impacted by the coronavirus?
- Do we have large inventory and supply reserves to continue business operations in the event of a supply chain disruption?
- Is alternative product sourcing available if we cannot access our usual supply source?
- Will our sources of funding be affected?
- Will we be able to access the debt markets at favorable terms?
- Will employee quarantine significantly impact productivity and output?
- Will we be in violation of customer or vendor agreements if stock levels drop below established thresholds or we cannot meet minimum commitments or other contractual obligations?
- Have we updated our forecasts to reflect new assumptions such as reduced customer demand or higher supply chain costs?
- Do our revised forecasts suggest that we will not be able to continue as a going concern?
- Have we assessed whether constraints on the movement of goods across international boundaries could impact our financial statements (including revenue recognition)?
- Will we need to incur additional outlays to support remote working arrangements for our employees?
- Does our insurance sufficiently cover business disruptions?
- For clinical stage companies, could clinical trial activities be adversely impacted due to a lack of participants or the inability to access hospitals and clinical sites?
Answering these questions will make it clear how much risk coronavirus poses to your business’s ongoing operations and what your disclosure obligations should be.
Step 2: Identify the best approach to address these risks
For each of the operational risks you have identified, determine the most pragmatic and viable way to handle them:
Mitigate
In some cases, you may find that risks can be effectively minimized, if not neutralized entirely. For instance, identifying alternative sources of raw materials and establishing a response plan in the event that your primary provider is unavailable will mitigate that risk.
Another example: Install collaboration and communication software to support a remote workforce and maintain productivity levels if your employees are quarantined or asked to work remotely.
Avoid
There are steps companies can take now to completely sidestep certain risks. Suspending all international travel – or perhaps domestic travel as well – for business purposes will minimize your workforce’s risk of exposure. Switching to alternative material or product sources now can remove any concerns if your primary vendor is located in a coronavirus hotspot.
Accept
If there are no viable alternatives or ways to mitigate these concerns, companies may have to accept a certain degree of risk for the foreseeable future. Ideally, you will only accept risks that either have an infinitesimal chance of occurring or would have a negligible impact on business operations.
Transfer
There may be language in your vendor contracts and insurance policies that effectively transfer risk to another party. If your insurance covers unforeseen business disruptions as a result of coronavirus, you can effectively pass that risk along, in part, to your insurance provider.
Step 3: Make necessary changes to internal controls or processes
Now that you have a clear understanding of your risk exposure and have a plan for addressing those issues, it’s time to look at your internal controls and processes and see what changes need to be made.
In some cases, you may find that only minimal changes are warranted as existing controls are generally sufficient. Perhaps building in incremental procedures or executing controls with increased scrutiny will insulate your organization from coronavirus-related risks.
In particular, consider updating (or increasing the focus on) controls in these key areas:
- Forecasting: Forecasts can impact a number of other controls: going concern (as discussed below), quarterly tax provisions, goodwill impairment assessments, etc. There may be significant changes to key assumptions, drivers, etc. used in your forecasts as a result of the coronavirus. Therefore, forecasts must be updated and stress-tested on a regular basis.
- Going concern: Delay in fundings or other cash flow concerns could threaten the company’s ability to continue as a going concern. Going concern assessments should be updated on, at a minimum, a quarterly basis considering all relevant assumptions. If the company does not believe it can continue to exist as a going concern, this must be disclosed in a timely manner within its public filings.
- Revenue recognition: Companies should reassess their contracts for revenue recognition and other accounting implications (such as newly created obligations).
- Public filings review: Business risk factors and other disclosures within the company’s public filings will need to be updated in a timely manner to address new and emerging risks.
- Contract review: Companies should review their vendor and partner contracts to determine if they could be held in breach of contract for failing to fulfill any obligations.
- Succession planning: The coronavirus poses a serious health risk. Companies should update their succession plan in the event that company leaders are unable to continue fulfilling their responsibilities and roles within the organization.
Step 4: Disclose and report your risk assessment
Several leading SEC officials recently issued a joint statement urging companies to disclose any financial risk that has emerged as a result of the coronavirus. In particular, management and audit committees should establish sufficient oversight across all financial reporting processes and internal controls so they can sufficiently address the developing situation. That includes asking probing questions to external auditors to ensure they have adequately contemplated these risks as part of their audit plan.
Even having taken steps to minimize risk and address the impact of the coronavirus, companies must revise financial forecasts to accurately reflect the threat posed by this public health crisis. Disclose any perceived risks stemming from the coronavirus crisis in all financial reports, including your 10-K and 10-Q forms.
Be as transparent as possible when disclosing risk. Every business will be impacted by the coronavirus to varying degrees. Accurate and timely financial reporting, auditing and risk assessments will help companies plan accordingly and ride out the storm.
It’s yet to be determined precisely how serious of a public health risk coronavirus presents, but there’s no question that it will significantly impact global business operations. With this guide in hand, you can effectively navigate this crisis and address any risk that it presents to your company.
Inoculate your business against the coronavirus now while there’s still time to prepare.