The technology for remote communication through distributed networks existed in rudimentary form during the 1990s,1 but sophisticated applications for distance learning, video teleconferencing, online chat and telemedicine developed modest acceptance in the early 21st century. Expanded bandwidth and network development partially explain this trajectory, but several other factors—particularly, human factors—must align well for the adoption of new technology.2
Habits and routines sometimes require an exogenous nudge to initiate change. The coronavirus pandemic prompted changes in behavior that have contributed to the ubiquity of telecommuting and remote conferencing. Survival depended on keeping distance and limiting face-to-face interaction. For many workers, technology became a lifeline to salvage the disrupted routines of business and society following lockdowns intended to slow the spread of the virus. Comparing today’s pandemic to the influenza pandemic of 1918, one could surmise that the ability to resume essential activities—even with an acceptable sacrifice of effectiveness—provides a distinct advantage that allowed toleration of public health policies without even greater disruption of the economy.
For a change to occur, it seems one needs to be “in a pinch.” Even when the technology is rough around the edges and the end user seems unprepared or unwilling, pressing needs produce efforts to accommodate new technology. Online teaching is better than no teaching; committee meetings on Zoom or Teams are better than no meetings (although we all prefer fewer, more impactful meetings). Everyone had to invest new energy to adapt to new technology, and this investment appears to be paying off. Not everyone has developed the required proficiency for online work and some even hate it, but the technology has allowed us to accomplish more today than in the past.
But our journey into the future continues, leaving us with questions. How much of this virtual world will remain part of our lives after the pandemic has passed? Will the technological shift leave lasting changes in the habits and practices of business and society? For auditors, navigating through this future requires an examination of the changing risk environment and our ability to identify and mitigate these risk areas. We should examine these questions further.
How Did We Fare?
Balancing healthcare benefits from lockdowns with the negative impact on the economy has been a challenge around the globe. While Denmark locked down the economy, Sweden did not. The outcomes are quite different in each country and it is too soon to say which approach proved superior. South Korea avoided the lockdown, but it tested people extensively and followed the test results by isolating infected individuals and contact tracing others who were likely at risk. Such measures may be effective, but they may not be compatible with privacy expectations (and laws) in other countries.
Variations in these approaches permit the study and assessment of outcomes, with possible benefits to future efforts to address pandemic conditions. Preliminary information suggests that targeted measures aligned to the risk of each community could have fared better than a blanket shutdown.3 Problems of overreach from regional edicts tend to disparately impact some communities with lower demographic risk. The US federal system mitigates those risk areas to some extent, but variations within the US states remain: Rural Virginia, for example, differs from areas within the state bordering the District of Columbia (DC).
Workplaces experienced differential impacts based on “essential” and “nonessential” designations by governments. For those with compatible work requirements, remote officing increased dramatically compared to pre-COVID times.4 These workers faced new challenges, including technology issues, increased (and perhaps different types of) distractions, reduced team cohesion and difficulties with communication.5 But offsetting benefits were also realized from avoiding the time and costs of commuting, not to mention eating meals at home and reduced wardrobe costs.
Other workers did not have the option of performing remotely but instead had to adapt to the restricted environment. Retail grocers focused on maintaining customer loyalty while assisting employees with staying healthy.6 Curbside pickup, home delivery of online orders and special shopping hours for seniors were among the steps taken by stores to adjust to the new conditions. Restaurants and bars offered takeout menus, adapting to online orders and pick-up or delivery options. The privately held office supply distributor W.B. Mason, recognizing that people away from the office still need supplies wherever they work, began delivering products such as coffee, paper towels and bathroom cleaners directly to consumers at their homes.7
Most schools and universities were not prepared for a mid-semester transition to remote learning. The amount of effort was overwhelming for teachers and students; even parents had to go through the frustrations of taking on new ways of doing things. Despite all these efforts, preliminary research on school-age students suggests only 70 percent of normal school year reading skills learning and approximately half of math learning was achieved.8 This presents a potentially lasting detrimental impact on the educational system, which will have to adapt to lower achievement in future years.
GETTING BACK TO NORMAL MAY ENTAIL A NEW NORMAL.
From Crunch Time to Calm
Getting back to normal may entail a new normal. The benefits of remote officing may attract some workers who prefer to continue this arrangement. We Company, a space renting firm, may find lesser demand for its services from organizations whose workers choose to remain at home. But other remote workers may find temporary office space attractive to provide options for in-person meetings or to get away from the distractions of the home environment. The net effect of these preferences is difficult to gauge, as tremendous variations exist across the world. Workers residing in low-cost housing environments are presented with economical alternatives to acquire and develop home-office space, while high-rent locales present greater pressure from multipurpose use of smaller living spaces. Employers will also be looking at their own space needs—if more of their workers prefer remote officing, dedicated offices may be inefficient. Meeting spaces and temporary workspaces may become the new normal in commercial real estate configurations. Demands for convenient access by workers may also change the location of these spaces, shifting them away from current headquarters and closer to where most employees are living.
The ability to work remotely may create a new demographic division within the workforce. Rather than white-collar and blue-collar labor, we may see a division based on those who work in the IT space (haves) and those who need to be physically present at work to add value (have nots). Workers in manufacturing, construction and other production work will continue to commute to their workspaces, along with many intermediaries dealing with moving material goods. However, the breakdown of labor needs within this space may shift. Personal customer contacts may become more limited if organizations shift to remote delivery instead of in-person contact, affecting the demand for fulfillment staff and telephonic or Internet contact instead of cashiers. As technology-leveraged skill sets become more demanding, it is possible that more jobs might be lost for those who are already in the have-nots category, while the haves gain even greater importance.
Although it may be too early to judge, the expectation is that the share of remote work in the total workspace will increase over time.9 Facebook Chief Executive Officer (CEO) Mark Zuckerberg asserts that in the long run, the company will permanently reconfigure its operations so that about half of its employees work from home (WFH). Twitter has announced that most of its employees will be allowed to keep working from home even after the pandemic passes. Unfortunately, job losses resulting from the pandemic have fallen disproportionately on those workers who cannot perform their work from home.10 Empty offices do not need cleaning crews; those lunching at home do not generate work for restaurant workers; and even Uber drivers may see fewer customers as people choose to stay close to their home bases.
Lasting Changes That Stick
While more organizations and workers are embracing the benefits of remote work during the pandemic, there are indications that the long-term value of WFH may not hold in all cases. A report on LinkedIn indicates that some experts believe extended remote work threatens a “decay in culture” as out-of-office workers face increased isolation, distractions and blurred lines between work and home life. The report also asserts that short-term success of WFH amid the pandemic has largely been rooted in established relationships, which are harder to build and maintain online.11 People lose touch when they are not personally present with some degree of frequency, and existing relationships may end, for example, due to retirement. It has been said that innovation and creativity can be built only with good rapport, which stems from personal contact, not a remote connection. While these are not proven assertions, the possibilities of human factors derailing a technological solution deserve consideration.
AS TECHNOLOGY-LEVERAGED SKILL SETS BECOME MORE DEMANDING, IT IS POSSIBLE THAT MORE JOBS MIGHT BE LOST
Economic benefits from working at home can be expected to continue beyond the pandemic, when lockdowns have been lifted. Savings measured by avoided costs for commuting, reduced office space, and reduced friction in remote conferencing with others will tend to incentivize business leaders and their employees to keep the gains they managed to achieve while fighting the virus. If work role expectations stabilize, some employees may even consider moving to a more remote residential area, reducing congestion and improving quality of life. At a macro level, environmental protection and energy savings could show visible improvements.
But the shifts will have proven detrimental to some workers and in some environments. For example, educators involved in kindergarten, elementary, or middle school, where face-to-face interaction is extremely important for the development of young people, are likely to find the WFH option to be unsustainable. The in-school vs. out-of-school options do not appear to present comparable achievement of the end goal of a student’s personal development. Health counselors may also find that remote sessions fail to deliver the same progress with their patients. When you cannot achieve your goals, preferences for comfort and convenience are insufficient to sustain remote work practices.
Changing Risk Landscape and the Auditor
Fellow ISACA® Journal columnist Steven J. Ross aptly puts it, “(C)hanging the definition of work necessitates a corresponding redefinition of security over the information with which we work.”12
BECAUSE THOSE WHO WFH ARE MOSTLY KNOWLEDGE WORKERS, ISSUES OF DATA PROTECTION, SYSTEMS SECURIT Y, INCIDENT MANAGEMENT AND PRIVACY REQUIRE CAREFUL RECONSIDERATION.
The growing acceptance of WFH qualifies as the redefinition of work, bringing along new challenges of information security. Because those who WFH are mostly knowledge workers, issues of data protection, systems security, incident management and privacy require careful reconsideration. Risk mitigation in the context of WFH requires a thorough and careful exercise in risk assessment; without it, the organization and its stakeholders could be vulnerable to new or heightened risk.
The single most important source of new or elevated risk is that remote work extends the boundaries of the formal information system of the entity. An elevated level of remote engagement calls attention to a comparatively porous system having more windows and gates than the wall protecting the traditional business edifice.13 Diverse communication carriers, varied end-user hardware and generous authentication protocols all lead to greater risk from increasing the porousness of the system.
Disaffected, disengaged or depressed employees also present organizational risk. Are those working remotely maintaining positive mental attitudes about their work and their employer? Organizations may need to invest additional resources to help affected employees with their needs. Current tax and economic conditions present challenges for employee self-help when it comes to technology investment, which employees must make with after-tax dollars. Enhanced employer investments to equip employees to function effectively and efficiently in a WFH environment, including access to technical support, may be required. Providing regular opportunities for feedback and finding new ways to measure the effectiveness of remote work may be needed to avoid productivity losses and potential risk scenarios from careless or thoughtless behavior. Efforts to provide regular opportunities for interaction and avenues for accessing assistance may be more important than ever.
Remote work arrangements can present new tax consequences for both enterprises and employees,14 presenting compliance and fiscal demands that had previously not been considered. Activities by employees in remote locations may also trigger new regulatory responsibilities, affecting not only those employees, but the entire business enterprise. Where will firms get the resources to devote to these new compliance efforts? Perhaps some resources will come from travel budgets, which have been widely slashed after the pandemic.15
Organizations with staff working remotely should consider their policies governing that work. Such policies provide anchors to identify and develop measures to mitigate related risk. An ISACA® blog post lists specific areas organizations should address:16
- Switch to cloud-based storage.
- Require regular password changes.
- Limit access.
- Provide for remote support systems.
- Keep software and programs up to date.
Other factors to consider might include responsibilities for ownership, access, maintenance, and acquisition of hardware and software tools needed to function effectively in a remote role. For such a significant development in the life of an organization’s information systems, a disciplined approach to meeting these requirements, such as resources (including training), applications or procedures, and documentation, will be necessary to produce consistent and coherent standards that permit management to measure and assess employee and organizational progress.
The COBIT® framework naturally suits in this case, although other frameworks may also be effective in achieving the goal of systematically incorporating control risk factors of WFH. The application of COBIT to remote work was well illustrated in a recent article.17 The article emphasizes these areas of the COBIT framework:
- Manage critical assets.
- Manage network and connectivity security.
- Manage endpoint security.
- Manage business resilience.
Whether one likes it or hates it, the new normal that incorporates WFH in a significant way is here. It is important for every organization to develop an impact analysis for WFH and consider putting in place a plan to suitably address its impact.
IT IS IMPORTANT FOR EVERY ORGANIZATION TO DEVELOP AN IMPACT ANALYSIS FOR WFH AND CONSIDER PUTTING IN PLACE A PLAN TO SUITABLY ADDRESS ITS IMPACT.
Endnotes
1 For an early experiment in distance learning, see Raval, V.; Videotex in Education: An Empirical Study, USWEST Foundation, 1992
2 Raval, V.; “Window on the World: About the Future…,” Information Strategy: The Executive’s Journal, Fall 2000, p. 39–45
3 Ip, G.; “Lockdown or No? A New Look at the Costs,” The Wall Street Journal, 6–7 June 2020
4 Ozimek, A.; “The Future of Remote Work,” Upwork, June 2020, https://content-static.upwork.com/blog/uploads/sites/6/2020/05/26131624/Upwork_EconomistReport_FWR_052020.pdf
5 Ibid.
6 Kang, J.; “Wegman Pampered Its Shoppers, Now It Has to Protect Them,” The Wall Street Journal, 30–31 May 2020, https://www.wsj.com/articles/shoppers-were-pampered-at-wegmans-now-they-are-the-grocers-biggest-risk-115908112111
7 FitzGerald, D.; “Office-Supply Company Pivots to the Home,” The Wall Street Journal, 29 May 2020, https://www.wsj.com/articles/office-supply-company-makes-a-pivotto-your-home-office-11590667219
8 Hobbs, T. D.; L. Hawkins; “America’s Grand Learning Experiment in Remote Learning Fails,” The Wall Street Journal, 6–7 June 2020, https://www.wsj.com/articles/schools-coronavirus-remote-learning-lockdown-tech-11591375078
9 Op cit Ozimek
10 Torrey, H.; “Many Want to Keep Working From Home,” The Wall Street Journal, 28 May 2020
11 LinkedIn, “Beware of Permanent WFH,” https://www.linkedin.com/feed/news/beware-of-permanent-wfh-4852268/
12 Ross, S. J.; “I Left My Security in the Office,” ISACA® Journal, vol. 4, 2018, https://www.isaca.org/archives
13 Raval, V.; “Window on the World: The Borderless World,” Information Strategy: The Executive’s
Journal, Fall 2001, p. 44–48
14 Saunders, L.; “Working Out of State? Beware of Surprises,” The Wall Street Journal, 30–31 May 2020, https://www.wsj.com/articles/remote-working-from-a-different-state-beware-of-a-tax-surprise-11590744601
15 The Audit Executive Center Knowledge Brief, COVID-19: Longer-Term Impact on Internal Audit, The Institute of Internal Auditors, USA, 2020, https://dl.theiia.org/Documents/COVID-19-Longer-Term-Impact-on-Internal-Audit.pdf
16 Johannson, A.; “Here’s How Leading Organizations Keep Remote Workers Safe and Secure,” ISACA Now, 29 March 2018, https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2018/heres-how-leading-organizations-keep-remote-workers-safe-and-secure
17 Villanueva, L; D. Brewer; “Managing Remote Environments With COBIT 2019,” COBIT Focus, 30 March 2020, https://www.isaca.org/resources/news-and-trends/industry-news/2020/managing-remote-work-environments-with-cobit-2019
Vasant Raval, DBA, CISA, ACMA
Is professor emeritus of accountancy at Creighton University (Omaha, Nebraska, USA). The coauthor of two books on information systems and security, his areas of teaching and research interest include information security and financial fraud. He recently published a book on corporate governance. He can be reached at vraval@creighton.edu.
Edward A. Morse, CPA
Is a professor of law at Creighton University and holds the McGrath North Endowed Chair in Business Law. He is the incoming vice-chair of the American Bar Association (ABA) Cyberspace Law Committee. He can be reached at morse@creighton.edu.