“Driven by a lack of time and a fear of the unknown, many companies rely more on outside consultants than on internal management personnel who have a much better understanding of the true risks impacting the business,” says Chris Meshginpoosh, director of business advisory services for Kreischer Miller. “In many cases, this results in both remaining weaknesses in internal controls as well as excessive compliance costs.”
Outside consultants should serve as coaches during the internal control assessment and testing process, with the ultimate goal of ensuring management’s ability to identify and address future weaknesses in a timely manner. That way, key managers can adjust their systems to accommodate new business risks presented by issues such as acquisitions or entry into different markets.
Smart Business asked Meshginpoosh to address how an effective consultant can teach you how to instill controls that last, and why starting your assessment at the top will set the tone for your organization.
Concerning internal controls, in general, what have been some positive results from the push to comply with Sarbanes-Oxley?
As public companies have addressed the wide range of issues associated with the Sarbanes-Oxley Act, we have seen dramatic improvements in the quality of financial reports as well as a renewed focus on auditor independence. Additionally, the act resulted in more formal communication requirements between auditors and auditing committees that also contribute to more effective audits. Finally, the press surrounding the act has led to a noticeable elevation in the importance of internal controls to all businesses including privately held companies as well as not-for-profits.
The drawback, of course, is the potential cost of compliance. Fortune 500 companies can spend millions trying to comply with the act, and even small companies can spend well into the six figures. Consulting fees can add up when there is an improper balance of management and outside consultant participation. That leads to time spent addressing issues that are not really a concern for their specific organizations.
Outside consultants should act as facilitators, providing management with an understanding of the typical project framework, the risk assessment process, and common assessment techniques. Perhaps most importantly, an outside adviser can help management ensure the sufficiency of its risk assessment efforts, as well as identify potential internal control solutions based on the consultant’s experience with other companies.
What risks do business owners assume when they rely too heavily on outside consultants to assess internal controls?
No matter how qualified third parties are, they can overlook certain risks because they don’t know the business as well as management. Management should be involved and consultants should coach them through the compliance process.
Second, new risks to the company may emerge say, during an acquisition that were not part of a consultant’s initial assessment. Managers should take ownership of the ongoing evaluation process so they can continually evaluate the efficiency of their internal controls.
What is the most effective approach for establishing internal controls?
You should take a top-down approach. Your first concern should be dealing with entity level controls including the tone at the top. Do you have processes in place for anonymous reporting of potentially unethical activities? Do you have a code of conduct that employees understand? Does management set a strong ethical tone? Process level controls are important, but as we learned from cases like Enron, the tone at the top plays an enormous role in the timely prevention and detection of improper activities.
Next, review financial statements and determine the most significant balances and disclosures. Your goal should be to ensure that you focus your efforts on the greatest risks for your company. As part of this process, ensure that you seek the input of an experienced financial statement auditor. Research shows that an alarming proportion of material weaknesses relate to failures to implement effective controls around complex accounting issues.
It’s always a good investment to get constructive feedback from a professional who can train you to develop an assessment process that will work for you. Used properly, consultants can provide valuable advice without breaking the bank.
It’s about finding someone who can share knowledge and observations with management, as well as embed a strong understanding of the assessment process to ensure that management has the tools and skills necessary to maintain cost-effective internal controls on an ongoing basis.
CHRIS MESHGINPOOSH is director of business advisory services at Kreisher Miller. Reach him at email@example.com.