Internal Control: a Preventive Maintenance Program

You read about this in every newspaper in every town in the entire country: Some bookkeeper, trusted by the owner of a small business, embezzles thousands of dollars. If the theft doesn’t put owner out of business, it certainly causes a major headache.

The reason we hear of these cases so often is that, in a small business, there may only be the owner and a bookkeeper. The owner doesn’t like doing the books, doesn’t understand them, and relies on this one person to take care of things. The bookkeeper, who is usually having personal financial difficulties, takes a small amount of money intending to pay it back. No one seems to notice, so more is taken. Over a period of time, it starts to mount up to a lot of money.

This is where the concept of “internal control” comes in. Essentially, every business should have, at some level, an internal control system in place to protect against losses, both intentional and unintentional. This is because “internal control” systems will: 1) protect cash and other assets; 2) promote efficiency in processing transactions; and, 3) ensure reliability of financial records. An internal control system consists primarily of policies and procedures designed to provide reasonable assurance that these three objectives will be achieved. The size and complexity of the business will determine the extent of the internal control system.

Regardless of size, one of the most important aspects of an internal control system is the concept of separation of duties. Separating duties makes it more difficult for theft and errors to go undetected. It is highly unusual for two employees to “collude” in an effort to steal from the company.

I worked as an internal auditor for a newspaper chain for three years. My job was to walk in to the newspaper offices unannounced and go directly to the cash boxes, count them, and verify receipts. One of my most important audit steps was to make sure the internal control procedures were in place and working properly. Here are a few suggestions for internal control procedures regarding handling of cash:

- Allow only specific designated individuals to handle cash.

- Give responsibility for bookkeeping to an individual who does not handle cash.

- Use numbered receipts to document all payments.

- Make all bank deposits promptly.

- The person who prepares the bank reconciliation should be different than the one handling cash.

- If possible, the person who makes the bank deposit should be different than the one who handles the cash and the one who prepares the bank reconciliation.

- Make deposits intact with no amounts withdrawn to pay expenses.

- Keep cash and checkbook in a locked drawer or cash register.

- Since tills will never be 100% correct all the time, establish a tolerance level for overages and shortages to determine the point at which corrective measures will be triggered.

- Make all disbursements by check, except minimal amounts paid from petty cash.

- Make certain every payment is related to a paper document, such as a voucher, to ensure that a paper trail exists for all disbursements.

- Conduct random surprise counts of petty cash and cash drawers.

- Count inventory and other assets frequently and compare with company books.

An internal control system set up early as a preventative measure is more efficient than establishing a corrective system in reaction to a loss. If it so happens, that there is just you and the bookkeeper in your small business, you need to learn how to do some of the bookkeeping tasks so you can spot check the bookkeeper’s work. That, in itself, is an excellent preventative measure.