Not too long ago, I did a follow up call with a former client; just to see how they were doing. I found out that both their CFO and their COO had resigned. I thought, "Wow! How amazing was that timing? I made a phone call right at the time when we might be able to help!" The client agreed to re-engage us and I went to my first meeting. And right away we got hit with the bombshell: "Something is not right with the books; we think the CFO left with some money." Now we're doing a fraud investigation. So much for helping...
I say "So much for helping..." because a fraud investigation, much like an audit, is a review of transactions that already happened and therefore does nothing to promote growth, plan for the future or improve profit margins. As a matter of fact, such an investigation diverts resources away from growth initiatives and hurts profit margins in the form of additional professional fees.
What are Internal Controls?
Internal controls are the policies and procedures you establish to insure that a scenario, like the one I described above, does not happen under your watch. Examples would include things like: requiring multiple signatures on checks over a certain dollar amount; not allowing the same person to process a bill from a vendor as well as write the check to that vendor; and requiring department-head approval on expense report submissions. These processes may sound trivial, but they are imperative to not allow employees to easily exploit the system and take your hard-earned funds.
If my employees are trustworthy, isn't that enough?
I would agree that most people's intentions are good, but how do you know? When you go back and look at all those stories centered around a staff person stealing thousands of dollars over a period of years, the business owners reactions are all almost identical. They say, "How could they have done that? I treated them so well. And I trusted them." That should be enough to tell you that trust is not enough, and that trust is not an internal control.
Oversight is one of the most important internal controls. But as you grow your business, your focus has to be on growth and expansion, not on internal financial processes. Establish internal processes and procedures to eliminate the ability of an employee to succeed in harming your company because they know "the boss isn't looking." Expansion will require additional staff and rapid expansion means it would be nearly impossible for you to know everyone so well that you can claim you have no wrong-doers in your midst.
In the example I talked about above, oversight became weak and one high-ranking employee wound up with too much decision-making power. It turned out that he was creating fictitious expense reports and approving them himself. Couple that with the fact that it turned out this individual had a previous history of financial misdoings, and this company now realizes how important internal controls should have been. So whether you are a small company with modest growth or you are in the midst of a rapid expansion, make sure the internal control structure that you have in place is rock-solid and eliminate your risk of having an issue.
Do you think your internal controls are adequate to prevent issues? Contact us if you have any doubts.