Internal controls can often seem like a topic reserved for public companies with hundreds of employees and locations all over the world. But a system of internal controls is critical for both public and private companies, regardless of size, because it ensures that corporate assets are protected and that operations are appropriately managed.
Why Internal Controls Are Absolutely Critical For Your Company
Internal controls help you ensure you're always compliant with legal and reporting requirements. Having clearly defined systems of operations provides you and your executive team with reasonable certainty that objectives will be reached and deliverables fulfilled in a predictable and compliant manner.
In addition to establishing consistency throughout your company's operations, internal controls also help you decrease opportunities for internal fraud and theft. When an individual has the pressure, rationale, and opportunity to commit theft, it will happen.
Earlier this year, a year-long audit by the State of Alabama resulted in two former middle school employees being required to pay dues totaling over $14,000 to the Montgomery Public Schools system. The audit, which concluded near the end of January this year, discovered that some employees had used school funds to cash paper checks and make personal purchases. The lack of adequate internal controls also meant that staff failed to promptly submit and deposit receipts from athletic events and student activities, and neglected to document gift cards that were purchased to reward student academic achievements.
While you may not be able to affect whether someone feels the pressure of student loan debt, you can control whether they can successfully act on the impulse to embezzle or mix funds. Proper oversight of established procedures mitigates such a risk and improves mutual accountability throughout your company.
Best Practices For Developing & Maintaining Effective Internal Controls
Whether you're a large or small company, the word "audit" isn't likely to be on your list of favorite words. In any company, staff in all positions and ranks fear the day when their company fails an audit. For small and mid-sized businesses, this can occur because of lean resources and human error caused by a few people filling too many roles.
For larger companies and enterprises, a lack of proper infrastructure and unchecked human error can result in a failed audit, which can damage credibility and trust among stakeholders and customers. With this in mind, here are some tips to help your company develop healthy internal controls and be better prepared for audits.
Keep things tidy by separating duties among employees
Failure to divide functions like transaction processing, financial statement preparation, and other critical responsibilities can occur when businesses rely on a few founding or key employees to perform numerous, often unrelated tasks, to help drive the company's growth. These blurred lines of responsibilities can present many opportunities for employee theft and misuse of funds.
For example, let’s say your bookkeeper is responsible for entering bills. If they’re also responsible for paying company bills, it’s reasonable to assume that they could input false vendors and siphon company funds. Or, if they are in charge of maintaining your petty cash, they may begin embezzling small amounts to stay unnoticed.
Delegating duties is an obvious answer to properly separating duties, but here are some other tips for separating tasks:
Begin by clarifying which processes should be delegated to separate parties
Ensure that no one person controls an entire process from start to finish
Make sure appointed employees are well-trained and educated for their role
Provision staff so they're only able to access information necessary for their role
Routinely review reports to ensure that tasks and processes are performed correctly
You can also deter fraud by accepting ACH payments from vendors and customers and managing them using software solutions like Bill.com. At my accounting firm, we integrate Bill.com with QuickBooks® Online to automate bill payment workflows for our clients.
In addition to automation, Bill.com also provides access controls that allow us to provision users based on their role and tracks each transaction from the time it enters our system. This helps us create an audit-ready environment for our clients.
Develop written policies and procedures for tasks and processes
Companies in every industry can benefit from recording clear policies for everything from the deadlines for financial statements to how to proceed with debt collection. If your staff is confused or inconsistent when following critical procedures, it may be time to decide and record the steps involved objectively. Policies clarify your processes and improve your company's productivity because there are fewer guesses, a decrease in unnecessary searches for answers, and less overall stress on staff.
When it comes to checks and payments, make sure you - not your bookkeeper - are signing or approving them. This helps you make sure that you see all payments, electronic or paper, before they go out the door. This reduces the temptation and opportunity for an employee to steal from you as well, since they know you’ll most likely see it.
To document your company policies adequately, you'll need to:
Define the purpose and intended outcome of the process or task
List out the steps followed throughout the process
Describe any deliverables, performance metrics, or reporting activities
Setting up an approval workflow in Bill.com is fairly straightforward and is designed as part of the onboard process for new accounts.
Examine communication processes & improve where needed
Even the best system of internal controls must be modified as operational needs shift or industry changes dictate. But, when a management team is unaware of a problem or difference in a workflow, chaos can occur and threaten consistent operations and compliance. This reality highlights the importance of timely, collaborative communication between management teams and stakeholders regarding significant events within the company.
Here are some ways to improve the communication process within your company:
Avoid data silos, where only a few people are informed about projects or company policies
Form cross-departmental teams on critical projects to get varying perspectives
Hold team lunches and staff retreats to build camaraderie among staff members
Stay on top of things with routine monitoring and management
Perhaps the most crucial step in developing internal controls is monitoring them to ensure the controls are efficient and effective for employees. For example, reviewing statements regularly to ensure accuracy, or examining a month-end checklist often to detect any discrepancies. Routine examinations of your controls can help you spot inconsistencies, identify inefficiencies, and take action to improve them.
Maintaining and improving your company’s internal controls takes a lot of time and careful planning for continued effectiveness. Here are some great resources you can use to learn more about audit preparation, fraud prevention, and the best bookkeeping practices: