Setting up internal controls is challenging for small and midsized companies. Generally, you don’t have that many employees, and they tend to wear multiple hats. The business processes that fuel day-to-day operations take priority, while the internal control aspect often takes a backseat.
“We often hear, ‘This is too much work. I don’t have time for this,’” says Michaela McGinn, CPA, principal and director of assurance services at Rea & Associates.
“If you don’t have time to look at who has control of your cash, then — and this is a great example given to me — if I handed you a briefcase of $100,000 and said, ‘Here hold this for me,’ would you be OK with that?” she says. “The answer might be yes, but what if it was $500,000 or $1 million?
“That’s what you’re doing when you give full access to information and resources with no one monitoring it.”
Smart Business spoke with McGinn about key internal controls that even organizations with limited resources can implement.
How do internal controls differ among different sized organizations?
A single owner and two to three people in an accounting department cannot recreate the control environment of a Fortune 100 company, but you can still provide yourself a level of comfort and oversight.
There are two types of internal controls. Preventative controls are established to ensure something doesn’t happen, such as limits on certain transactions and segregation of duties. A detective control is a check on the backside to make sure there wasn’t human error and your assets are secure. An example is the reconciliation of accounts and a review of that reconciliation.
Smaller companies may need to utilize more detective than preventative controls because there is a greater chance that one person has full access to funds — from making deposits to issuing checks and payroll to performing monthly bank reconciliations. It’s a matter of choosing what controls can be done in a timely, economic, efficient way.
If you trust your employees completely, are controls even necessary?
If Mary has worked for you for 30 years, and you trust her with everything, you still need to implement controls for both her benefit and yours. Don’t put Mary in a position — if you truly trust her — where that trust is being questioned. The more you separate out the different pieces of a process, the more you reduce the potential risk associated with inaccuracies or coverage of assets.
What are some best practices for setting up these controls?
All operational processes need to be documented and re-evaluated at least annually. If possible more than one employee needs to be familiar with the process, so in the case of death, sickness or job loss someone else can pick up the task.
Do monthly reconciliations of key accounts, such as receivables, cash, inventory, payables, payroll costs, etc. Then, have those reconciliations independently reviewed. For example, the controller or business owner could review reconciliations by a payroll clerk.
Limit your exposure with approval processes and limits on transactions. You also can restrict access to the general ledger — allowing only a very limited number of individuals the ability to post entries vs. read-only access.
Review your vendor lists to keep them up to date, and have someone look over the standard and nonstandard journal entries.
On the receivables side, put together a policy for creating credit limits for customers, and then evaluate that policy regularly to ensure you’re following it.
Other areas to monitor are where employees have the ability to manipulate something for the benefit of somebody else. If you have a bonus or commission structure based on a formula, determine whether people can beef up sales financial information to make it look better.
If you’re unsure where to start, with the help of your accountant or auditor, pick a few key controls and weave them into the day-to-day or monthly process. There are many ways to accomplish this without hiring additional bodies or increasing the roles and responsibilities of your people on a significant level — and at the end of the day, it provides a greater peace of mind and helps protect what’s most important to the company and its owners.
Insights Accounting is brought to you by Rea & Associates
