Internal controls should be designed to safeguard assets and help prevent or detect losses from employee dishonesty or error; the owner’s involvement in a small organization is important in maintaining good internal controls. One area of focus should be segregation of duties, which largely means having different people responsible for authorizing transactions or contracts, recording transactions in the general ledger, maintaining custody of assets, and reconciling accounts. The basic principle is that no one individual should have access to all phases of a transaction. Smaller organizations tend to have limited staffing and, therefore, owners find it difficult to implement adequate segregation of duties. Here are some examples of how owners of small organizations can mitigate the risk of having limited employees and a lack of segregation of duties.
Segregation of Duties
Owners should have responsibilities over certain phases of a transaction cycle when there are staffing constraints. Here’s how to improve segregation of duties over cash and payroll in a three-person office.
Monitoring of Information Systems
Owners should also be monitoring user access rights in accounting and information systems. Employees should only be granted access rights necessary to complete their duties and should not have full access rights to all aspects of a system. If full access rights are necessary for that individual, then the owner should make sure to detail review journal entries on a regular (e.g. monthly) basis, as well as investigate trends or variances that do not meet their expectations during their monthly review of the financial reports. As job responsibilities change over time, access rights should be reviewed periodically and updated to reflect those responsibilities.
Reviewing Financial Reports
Owners should also be reviewing financial reports on a monthly basis. This may involve reviewing key industry metrics, budget-to-actual variances, month-to-month variances, year-over year variances and any other relevant data. Any differences noted from the owner’s expectations during review of these reports should be followed up on. If they cannot get a valid answer to a question, they should be reviewing account details and requesting supporting documents for anything that appears out of the ordinary.
Implementing good internal controls in a small business is important and can be done. The owner’s involvement in daily activities, responsibilities in a transaction cycle and providing oversight and regular review of the financial reports are the best lines of defense in preventing or detecting errors or fraud in a small organization with limited resources.
As always, if you are unsure about how to segregate these duties and you see that a single person may have too much influence over the process, contact your Henry+Horne CPA who can help by suggesting good segregation controls for your specific company.