Internal controls are not typically a topic at management meetings until fraud occurs in the company or is in the news. The idea of fraud happening in business is generally considered preposterous; we all have trustworthy employees and appropriate controls. However, according to the 2020 Report to the Nations published by the Association of Certified Fraud Examiners, 26% of all frauds reported occur in companies that have less than 100 employees. Those frauds resulted in a median loss of approximately $150,000. Bottom line, fraud happens, and it is not a big company or industry-specific problem.
When COVID-19 caused workplaces to shut down and operate out of people’s homes, internal controls were not at the forefront. However, as we move into a more standardized work from home environment, it is essential to keep internal controls in mind and improve procedures that may have been seen initially as a short-term policy.
Here are five questions you should be asking related to your internal controls
1. IS UPPER MANAGEMENT OR OWNERSHIP PRIORITIZING INTERNAL CONTROLS?
Tone at the top is a classic buzz phrase for successful management. However, for internal controls, letting everyone know that upper management is actively involved reduces the risk of fraud occurring. Ask questions about an account, a journal entry, or a deposit to let people know you are engaged and involved. Something as simple as adding a calendar reminder stating that you will be reviewing the bank statement sets the tone that controls are important and worth the time. With the pandemic causing people to work in different locations, communicating and asking questions becomes an integral part of a control environment.
2. WHERE ARE THE DOCUMENTS?
The accounts payable clerk may have been working from home for the past year. Make sure to know the location of the following: check stubs, check stock, and supporting invoices. Having these items on the server or in someone’s inbox is not a filing system. Prior to working from home, would it have been acceptable for 10 months of invoices to be unfiled? Perhaps the pandemic pushed the company into a paperless environment and process, but access to the documents is still an important control to maintain.
Another consideration is physical controls that were in place. Documents that were protected by the fire door on the file room in the office in 2019 are now in someone’s home. Again, this is no longer a short-term issue, and standardization should be part of any filing system. Companies should consider moving physical files back into the office or defining an electronic filing system.
3. WHO HAS ACCESS?
With the quick switch to a virtual environment and perhaps a change in the general IT management, a company should consider if the proper access to files has been maintained. Not everyone needs access to every type of file. This issue also occurs in companies that see rapid growth. The policies in place for a 10-person office are no longer applicable for the 30 or 50 person office. Companies may want to consider a more restrictive environment with the increase in access points to their servers.
4. DO YOU HAVE A BACKUP PLAN?
This question has a fundamental IT and internal control aspect. Are files saved locally, and as a result, are backups to a central server no longer occurring? Or if computers are receiving crucial security upgrades if they are no longer regularly attached to the server? These are important questions to ask and verify that best practices are being followed.
From a financial internal control standpoint, a classic question is, can an employee take time off and have someone else fill their role? Perhaps you had a backup plan when everyone was in the office, but with the accounting department working from home, you have lost this crucial control. Unfortunately, this goes beyond an internal control function in the current environment. You should be prepared to have someone fill in key roles in case someone is away from work for an extended period with COVID-19 or for any other reason. Additionally, requiring employees to fill in for other employees (whether due to vacations, extended leaves of absence or other) provides the added internal control benefit of an outside look into critical activities performed by employees with financial responsibilities.
5. HAVE YOU DOCUMENTED AND APPROVED THE CURRENT SYSTEM?
Internal controls cannot stay static in a normal situation. Accordingly, as things continue to change because of COVID-19, a company should conduct a walkthrough of their controls. Verify what is happening has been approved and is at least to the same level of controls as was occurring in 2019. This ties back to the tone at the top and ensures employees know the importance of keeping a sound control environment, even during a pandemic.
QUESTIONS?
Internal controls are critical for companies to keep front of mind. We recommend that management complete a self-assessment of the changes in controls over the past year and make improvements as needed. Integrating internal controls into a company’s processes does not need to mean severely increasing the overhead charges. Small tasks requiring minimal time can be introduced to limit risk. Smith Schafer is here to help in assessing and improving your control environment. We will help identify the risks you face and evaluate the controls you have in place. You will receive a findings report highlighting recommendations and best practices. Click here to schedule a free 30-minute consultation with one of our professionals.
