Who hasn’t heard of ENRON, WorldCom or Health South, infamous examples of companies in which the system of internal controls failed resulting if significant personal losses to employees and investors. Were these just examples of big company failures or are smaller companies susceptible to similar failures?
The responsibilities of the Chief Financial Officer (CFO) are many and varied. One of the more important functions that the CFO performs is to establish a system of controls so that reasonable confidence exists that the business will operate as planned, that financial reporting is timely and accurate and the business complies withe applicable laws and regulations. So what are some of the attributes of internal control systems?
Separation of duties: This is an extremely important but often overlooked control but small business owners. From the point of startup through the early years of growth there are few employees in the business so there simply isn’t enough people for the purpose of separating duties. As the business continues to grow, the development of a system of internal controls simply doesn’t pop up on the owners radar. As the business grows it is important to separate various steps in the business processes. For example, a basic control principle is that the person that keeps the accounting records should not have access to the monies that are received nor should they have check signing authority. Another example is that the person who keeps the records for inventory should not have access to the physical inventory.
Management support: Another critical principle is that all members of the management team must support the system of controls. Not only must each member of the management team express support for the internal control systems, they must ensure that each of the members follow the spirit of the control. In addition, they cannot overlook breaches in the system of controls. Each apparent violation of the control process must be thoroughly investigated.
Responsibility: It shouldn’t come as any surprise that no system of controls will work unless someone is held responsible for them. Every control must have someone designated as responsible for that control. An important element is that they must be a mechanism for monitoring the system of controls and providing feedback to the person responsible. Just a reminder, anytime you give someone responsibility for something, you also have to give them the authority to call others to task should they fail to adhere to the control. If management is serious about wanting employees to comply with the system of controls, there must also be appropriate consequences with the don’t comply.
Error Reporting: Are the controls functioning as intended or are they not? Some mechanism must be set up to report instance when a control fails. In addition to establishing computer based reporting, it is important to check with customers and vendors to make sure sales and purchasing processing are working properly. Involvement of employees is essential to ensuring that controls work as intended as they are the ones dealing with customers and vendors and know when things run amuck.