Internal Controls are Always a Good Idea

I recently completed a ‘self-test’ in the Journal of Accountancy, March 2010 edition, titled “Internal Control:  Test Your Knowledge” and it reminded me of several questions that I have received from my clients. Many individuals within organizations believe that internal controls are only really necessary for large companies. This is a fallacy. Internal controls are VERY important for all types of organizations. Even if a company is very small, with only a few people working in the accounting department, processes can be developed to ensure that a sound control environment is consistently maintained.

It can be a daunting task to get individuals to engage in making changes to the processes and controls already in place at their organization but when they are educated on how important the controls really are they may be more willing to with stain from their resistance to change.

The 2008 report to the Nation on Occupational Fraud and Abuse estimated that US organizations lose 7% of their annual revenues to fraud which translates to approximately $994 billion in fraud losses. Losses were noted to be significantly lower in the cases where the organization had implemented controls. Small businesses were noted to be especially vulnerable to occupational fraud. The median loss suffered by organizations with fewer than 100 employees was $200,000 which is higher than the median loss in any other category, including the largest organizations. Lack of adequate internal controls was most commonly cited as the factor that allowed fraud to occur.  To read more on this report go to http://www.acfe.com/resources/publications.asp?copy=rttn

One of the key parts of the ‘self-test’ reads as follows: “Internal control is a process designed to…achieve effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations.” What organization doesn’t want to process transactions more efficiently, have accurate financial statements to their stakeholders or ensure they are in compliance with applicable laws and regulations? Properly designed internal controls can lead an organization in the right direction.

I have found the following to be a handful of a few good controls (this is not intended to be a list of the minimum controls an organization should have; simply it is a few of the controls that I think are very important):

1. Do not underestimate the power of “Tone at the Top” – if management skirts issues under the table their subordinates will assume they can do the same. This includes maintaining an oversight body (Board of Directors, etc) that has intimate knowledge of how the company operates and understands how to read and process financial information
2. Implement “Big Brother” approaches – people are less likely to stray from doing the right thing if they know someone is out there watching over their actions

Another step I highly recommend is to gain an in depth understanding of your company’s processes and procedures and see where the weaknesses are; then develop internal controls to address the identified risks.

To take the brief test to determine your level of understanding of internal controls go here:  http://www.journalofaccountancy.com/Issues/2010/Mar/20092240.htm