Designing internal control procedures is often met with much reluctance. It can be hard to see the long term payoff of implementing a procedure when faced with the upfront time investment. This is especial true when comparing the costs of implementation to the individual transactions themselves which may each be highly immaterial. However, the payback has to be viewed in the aggregate to appreciate what the long run gains in efficiency that designing and implementing controls provide. If you are going to take the time to design and implement a control here is some advice on how to create a bullet proof procedure that will help your organization reduce errors, fraud and wasted time and resources.
The elements that your bullet proof procedure should have are:
- It should not be reliant on someone having to remember to do something. What this really means is that every action or step in the process should have a 'triggering' event or source document. That may appear obvious but I have seen too many accounting procedures manuals with things like 'the bookkeeper runs a weekly AP report to determine what items to pay'. The bookkeeper shouldn't run anything. Instead the accounting system should use scheduling software or a reminder system (this is already built into Quickbooks) to notify the bookkeeper.
- Make workarounds less convenient or more annoying. It is human nature to resist change or to try and find shortcuts. If staff circumvent controls then the effectiveness of the procedure will be undermined. Your control should be designed to be preferable to alternative workarounds to provide incentives for your staff to use the process you have created. If the workaround appears more appealing you may need to take a critical look at the design of your control. It may be your control is inefficient and the workaround is better!
- Multiple independent verifications or authorizations. This is similar in concept to the need for segregation of duties in your internal controls. The idea is that you need to have multiple opportunities built into the procedure to identify errors. For example with a triple match system (purchase order-receiving report-invoice) you get three opportunities to root out problems. If you believe that your organization is too small, consider that this is a good opportunity to incorporate staff outside the accounting function into the process. Can someone from marketing get involved with customer collections/receipting for instance to follow up on outstanding items? Could be an opportunity to reach out to customers and hear any complaints that might have lead to a late or non-payment.
- Exception handling. Similar to number 3 above except here we are looking at the need for a failsafe. Exceptions will occur and things will fall through the cracks or get lost. Is there a procedure in place to make sure these exceptions get to someone who can direct them back into the standard workflow? For instance if you receive vendor invoices via email is there an email catchall and is someone responsible for checking that catchall folder for invoices that get directed to general company addresses?
- Automation. Simply put, automate everything you can. Bill payment, automate it. Journal entires, automate them. Reports writing, automate it. One important warning here. If you set up recurring/automated payments, entries, etc. make sure to use the 'end by' functions of these tools. It is easy to setup a recurring payment to run forever. However, check the contract and if the payment should end after say 30 payments, build that into the payment structure.
For tips on improving efficiency and reducing risk, signup for the Controlzkit newsletter here.