Mitchell Franklin; Patty Graybeal; Dixon Cooper

The use of internal controls differs significantly across organizations of different sizes. In the case of small businesses, implementation of internal controls can be a challenge, due to cost constraints, or because a small staff may mean that one manager or owner will have full control over the organization and its operations. An owner in charge of all functions has enough knowledge to keep a close eye on all aspects of the organization and can track all assets appropriately. In smaller organizations in which responsibilities are delegated, procedures need to be developed in order to ensure that assets are tracked and used properly.

When an owner cannot have full oversight and control over an organization, internal control systems need to be developed. When an appropriate internal control system is in place, it is interlinked to all aspects of the entity’s operations. An appropriate internal control system links the accounting, finance, operations, human resources, marketing, and sales departments within an organization. It is important that the management team, as well as employees, recognize the importance of internal controls and their role in preventing losses, monitoring performance, and planning for the future.

Elements of Internal Control

A strong internal control system is based on the same consistent elements:

establishment of clear responsibilities
proper documentation
adequate insurance
separation of assets from custody
separation of duties
use of technology

Establishment of Clear Responsibilities

A properly designed system of internal control clearly dictates responsibility for certain roles within an organization. When there is a clear statement of responsibility, issues that are uncovered can be easily traced and responsibility placed where it belongs.

As an example, imagine that you are the manager of the Galaxy’s Best Yogurt. On any shift, you have three employees working in the store. One employee is designated as the shift supervisor who oversees the operations of the other two employees on the shift and ensures that the store is presented and functioning properly. Of the other two employees, one may be solely responsible for management of the cash register, while the others serve the customers. When only one employee has access to an individual cash register, if there is an overage or shortage of cash, it can be traced to the one employee who is in charge of the cash register.

Proper Documentation

An effective internal control system maintains proper documentation, including backups, to trace all transactions. The documentation can be paper copies, or documents that are computer generated and stored, on flash drives or in the cloud, for example. Given the possibility of some type of natural (tornado or flood) or man-made (arson) disasters, even the most basic of businesses should create backup copies of documentation that are stored off-site.

In addition, any documentation generated by daily operations should be managed according to internal controls. For example, when the Galaxy’s Best Yogurt closes each day, one employee should close out and reconcile the cash drawer using prenumbered forms in pen to ensure that no forms can be altered or changed by another employee who may have access to the cash. In case of an error, the employee responsible for making the change should initial any changes on the form. If there are special orders for cakes or other products, the order forms should be prenumbered. The use of prenumbered documents provides assurance that all sales are recorded. If a form is not prenumbered, an order can be prepared, and the employee can then take the money without ringing the order into the cash register, leaving no record of the sale.

Adequate Insurance

Insurance may be a significant cost to an organization (especially liability coverage), but it is necessary. With adequate insurance on an asset, if it is lost or destroyed, an outside party will recoup the company for the loss. If assets are lost to fraud or theft, an insurance company will investigate the loss and will press criminal charges against any employee found to be involved. Very often, the employer will be hesitant to pursue criminal charges against an employee due to the risk of lawsuit or bad publicity. For example, an employee might assume that the termination was age related and is going to sue the company. Also, there might be a situation where the company experienced a loss, such as theft, and it does not want to let the general public know that there are potential deficiencies in its security system.

If the insurance company presses charges on behalf of the company, this protects the organization and also acts as a deterrent if employees know that the insurance company will always prosecute theft. For example, suppose the manager of the Galaxy’s Best Yogurt stole $10,000 cash over a period of two years. The owner of the yogurt store will most likely file an insurance claim to recover the $10,000 that was stolen. With proper insurance, the insurance company will reimburse the yogurt store for the money but then has the right to press charges and recover its losses from the employee who was caught stealing. The store owner will have no control over the insurance company’s efforts to recover the $10,000 and will likely be forced to fire the employee in order to keep the insurance policy.

Separation of Assets from Custody

Separation of assets from custody ensures that the person who controls an asset cannot also keep the accounting records. This action prevents one employee from taking income from the business and entering a transaction on the accounting records to cover it up. For example, one person within an organization may open an envelope that contains a check, but a different person would enter the check into the organization’s accounting system. In the case of the Galaxy’s Best Yogurt, one employee may count the money in the cash register drawer at the end of the night and reconcile it with the sales, but a different employee would recount the money, prepare the bank deposit, and ensure that the deposit is made at the bank.

Separation of Duties

A properly designed internal control system assures that at least two (if not more) people are involved with most transactions. The purpose of separating duties is to ensure that there is a check and balance in place. One common internal control is to have one employee place an inventory order and a different employee receive the order as it is delivered. For example, assume that an employee at the Galaxy’s Best Yogurt places an inventory order. In addition to the needed inventory, the employee orders an extra box of piecrusts. If that employee also receives the order, he or she can take the piecrusts home, and the store will still pay for them. Check signing is another important aspect of separation of duties. Typically, the person who writes a check should not also sign the check. Additionally, the person who places supply orders should not write checks to pay the bills for these supplies.

Use of Technology

Technology has made the process of internal control simpler and more approachable to all businesses. There are two reasons that the use of technology has become more prevalent. The first is the development of more user-friendly equipment, and the second is the reduction in costs of security resources. In the past, if a company wanted a security system, it often had to go to an outside security firm, and the costs of providing and monitoring the system were prohibitive for many small businesses. Currently, security systems have become relatively inexpensive, and not only do many small businesses now have them, they are now commonly used by residential homeowners.

In terms of the application of security resources, some businesses use surveillance cameras focused on key areas of the organization, such as the cash register and areas where a majority of work is performed. Technology also allows businesses to use password protection on their data or systems so that employees cannot access systems and change data without authorization. Businesses may also track all employee activities within an information technology system.

Even if a business uses all of the elements of a strong internal control system, the system is only as good as the oversight. As responsibilities, staffing, and even technology change, internal control systems need to be constantly reviewed and refined. Internal control reviews are typically not conducted by inside management but by internal auditors who provide an impartial perspective of where controls are working and where they can be improved.

Purposes of Internal Controls within a Governmental Entity

Internal controls apply not only to public and private corporations but also to governmental entities. Often, a government controls one of the most important assets of modern times: data. Unprotected financial information, including tax data, social security, and governmental identifications, could lead to identity theft and could even provide rogue nations access to data that could compromise the security of our country. Governmental entities require their contractors to have proper internal controls and to maintain proper codes of ethics.

Ethical Considerations

Ethics in Governmental Contractors

Government entities are not the only organizations required to implement proper internal controls and codes of ethics. As part of the business relationship between different organizations, governmental agencies also require contractors and their subcontractors to implement internal controls to ensure compliance with proper ethical conduct. The Federal Acquisition Regulation (FAR) Council outlines regulations under FAR 3.10,⁷ which require governmental contractors and their subcontractors to implement a written “Contractor Code of Business Ethics and Conduct,” and the proper internal controls to ensure that the code of ethics is followed. An employee training program, posting of agency inspector general hotline posters, and an internal control system to promote compliance with the established ethics code are also required. Contractors must disclose violations of federal criminal law involving fraud, conflicts of interest, bribery, or gratuity violations; violations of the civil False Claims Act; and significant overpayments on a contract not resulting from contract financing payments.⁸ Such internal controls help ensure that an organization and its business relationships are properly managed.

To recognize the significant need for internal controls within the government, and to ensure and enforce compliance, the US Government Accountability Office (GAO) has its own standards for internal control within the federal government. All government agencies are subject to governance under these standards, and one of the objectives of the GAO is to provide audits on agencies to ensure that proper controls are in place and within compliance. Standards for internal control within the federal government are located within a publication referred to as the “Green Book,” or Standards for Internal Control in the Federal Government.

Link to Learning

Government organizations have their own needs for internal controls. Read the GAO “Green Book” to learn more about these internal control procedures.

Purposes of Internal Controls within a Not-for-Profit

Not-for-profit (NFP) organizations have the same needs for internal control as many traditional for-profit entities. At the same time, there are unique challenges that these entities face. Based on the objectives and charters of NFP organizations, in many cases, those who run the organizations are volunteers. As volunteers, leaders of NFPs may not have the same training background and qualifications as those in a similar for-profit position. Additionally, a volunteer leader often splits time between the organization and a full-time career. For these reasons, internal controls in an NFP often are not properly implemented, and there may be a greater risk of control lapse. A control lapse occurs when there is a deviation from standard control protocol that leads to a failure in the internal control and/or fraud prevention processes or systems. A failure occurs in a situation when results did not achieve predetermined goals or meet expectations.

Not-for-profit organizations have an extra category of finances that need protection, in addition to their assets. They need to ensure that incoming donations are used as intended. For example, many colleges and universities are classified as NFP organizations, and donations are a significant source of revenue. However, donations are often directed to a specific source. For example, suppose an alumnus of Alpha University wants to make a $1,000,000 donation to the business school for undergraduate student scholarships. Internal controls would track that donation to ensure it paid for scholarships for undergraduate students in the business school and was not used for any other purpose at the school, in order to avoid potential legal issues.

Identify and Apply Principles of Internal Controls to the Receipt and Disbursement of Cash

Cash can be a major part of many business operations. Imagine a Las Vegas casino, or a large grocery store, such as Publix Super Markets, Wegmans Food Markets, or ShopRite; in any of these settings, millions of dollars in cash can change hands within a matter of minutes, and it can pass through the hands of thousands of employees. Internal controls ensure that all of this cash reaches the bank account of the business entity. The first control is monitoring. Not only are cameras strategically placed throughout the store to prevent shoplifting and crime by customers, but cameras are also located over all areas where cash changes hands, such as over every cash register, or in a casino over every gaming table. These cameras are constantly monitored, often offsite at a central location by personnel who have no relationship with the employees who handle the cash, and all footage is recorded. This close monitoring makes it more difficult for misuse of cash to occur.

Additionally, access to cash is tightly controlled. Within a grocery store, each employee has his or her own cash drawer with a set amount of cash. At any time, any employee can reconcile the sales recorded within the system to the cash balance that should be in the drawer. If access to the drawer is restricted to one employee, that employee is responsible when cash is missing. If one specific employee is consistently short on cash, the company can investigate and monitor the employee closely to determine if the shortages are due to theft or if they are accidental, such as if they resulted from errors in counting change. Within a casino, each time a transaction occurs and when there is a shift change for the dealers, cash is counted in real time. Casino employees dispersed on the gaming floor are constantly monitoring play, in addition to those monitoring cameras behind the scenes.

Technology plays a major role in the maintenance of internal controls, but other principles are also important. If an employee makes a mistake involving cash, such as making an error in a transaction on a cash register, the employee who made the mistake typically cannot correct the mistake. In most cases, a manager must review the mistake and clear it before any adjustments are made. These changes are logged to ensure that managers are not clearing mistakes for specific employees in a pattern that could signify collusion, which is considered to be a private cooperation or agreement primarily for a deceitful, illegal, or immoral cause or purpose. Duties are also separated to count cash on hand and ensure records are accurate. Often, at the end of the shift, a manager or employee other than the person responsible for the cash is responsible for counting cash on hand within the cash drawer. For example, at a grocery store, it is common for an employee who has been checking out customers for a shift to then count the money in the register and prepare a document providing the counts for the shift. This employee then submits the counted tray to a supervisor, such as a head cashier, who then repeats the counting and documentation process. The two counts should be equal. If there is a discrepancy, it should immediately be investigated. If the store accepts checks and credit/debit card payments, these methods of payments are also incorporated into the verification process.

In many cases, the sales have also been documented either by a paper tape or by a computerized system. The ultimate goal is to determine if the cash, checks, and credit/debit card transactions equal the amount of sales for the shift. For example, if the shift’s register had sales of $800, then the documentation of counted cash and checks, plus the credit/debit card documentation should also add up to $800.

Despite increased use of credit cards by consumers, our economy is still driven by cash. As cash plays a very important role in society, efforts must be taken to control it and ensure that it makes it to the proper areas within an organization. The cost of developing, maintaining, and monitoring internal controls is significant but important. Considering the millions of dollars of cash that can pass through the hands of employees on any given day, the high cost can be well worth it to protect the flow of cash within an organization.