All businesses need internal controls

Robert N. Cantor, CPA, CVA, CFE

This article was recently published in the Daily Record


Most owners of large and small businesses agree that incorporating internal controls is the best way to deter, detect and prevent fraud. Although it is true that the implementation of internal controls is easier with companies that have a lot of employees, small businesses also can set up controls that deter fraud.

Here is the issue: Business owners with  just a few employees perceive that there is insufficient time and resources to employ good internal controls. Further, they believe that there is little risk and think employee theft would never happen to them.

The fact is, the absence of controls makes small businesses especially vulnerable to fraudulent activities. Often, they do not see or understand the value of maintaining good controls. This mindset must change by managers and owners taking an aggressive approach to fraud prevention.

First, management needs to be educated on the three components that lead to fraudulent activity, which are pressure, opportunity and rationalization.  Segregation of duties is a main factor in an effective internal control system. Here are some basic steps that any small business can take to shore up their internal processes:

  • Separate purchasing and payment units. The individual approving invoices should not be the same person who selects vendors and makes purchases.
  • Bank statements. The opening and reviewing of bank statements and copies of canceled checks should be done by somebody other than the employee approving invoices for payment, writing checks and/or preparing the bank reconciliations.
  • Approval of bank reconciliations. This should be done by someone other than the person who prepares the reconciliation.
  • Cash receipts. The recording of cash receipts should be reviewed by someone other than the accounts receivable clerk. There should also be a check to make sure that all cash receipts have been deposited into the bank.
  • Journal entries. These should be prepared and recorded by one person and approved by another.
  • Somebody other than the accounts receivable clerk should generate and mail statements to customers and accounts payable clerks should not be able to generate and mail statements to vendors.

The implementation of these controls is dependent upon the number of employees. However, even if there are only two staff members, certain controls can be instituted. Having limited resources to utilize segregation of duties may mean that owners/senior management become involved in this area, enabling the placement of additional controls.

 Improve your processes

Certain steps and procedures that can be implemented, at little cost if any, are more operational in nature, such as the following:

  • Signing checks. Often overlooked but an important precaution, the owner should sign checks or designate only one person to sign in her or his absence rather than utilizing a signature stamp or signing checks in advance. The person you designate should not have access to the check stock or be able to write the check.
  • Mandate vacations. It should be required that all employees take regular vacations and that another employee carry out their duties while they are on vacation.
  • Questionable spending. Without violating any privacy acts, owners and managers should keep a watch on the lifestyles of the employees. If a bookkeeper travels a lot or makes expensive purchases, you should ask yourself where is the money coming from?
  • Cross-train. Employees working in one area of the business should alternate their functions on a regular basis.
  • Computer system rights. Depending on their current job functions, employees should only have rights to the accounting modules allowing them to perform their present job.
  • New employees. Prior to hiring, references and background checks should be conducted.

A foundation for compliance

On a broader scale, owners and senior management should demonstrate a genuine interest and concern in the enactment of sound internal controls. Setting a strong tone from management is a very effective deterrent to fraud. This includes providing a formal system to report employee concerns, without the fear of reprisal.

By the way, tips from insiders are the most effective way to confirm the existence of fraud. Keep communications open, build relationships and create a more positive work environment. Most important, consistently enforce policies to promote fairness in the workplace. These controls are more behavior-driven and have little or no cost to implement.

There are many internal controls that can and should be part of any small business’ operating procedures, depending on the size and type of business. While there may be some additional costs involved in implementing some of these controls, it likely will not be as much as the loss incurred by   fraud.  These controls may seem cumbersome, but they lay the foundation for continued compliance as the business grows and changes.

Robert N. Cantor is a manager in the litigation, forensics and business valuation department at Hertzbach & Company, P.A.