How to Improve Internal Control in a Small Business

There is always a risk in every business.  It is an inevitable fact that unpleasant incidents happen to a business, like price overcharging, theft and embezzlement of assets (cash, inventory and other assets) that involves outsiders, customers who shoplift, dishonest employees, and even some managers who commit fraud by taking advantage of their position.

Even for relatively small to medium size businesses, they are not exempted of such risks. Once a business handles money, holds valuable assets, and deals with a lot of people, they will eventually become a natural target or be quite prone for fraudulent schemes.

To protect against these risks, internal controls must be in place and be enforce vigorously. Various safety measures should be established to prevent, or at least to minimize losses from all types of fraudulence against the business from within and without.

But what is internal control?

According to the “Internal Control – Integrated Framework” published by COSO (Committee of Sponsoring Organizations of the Treadway Commission), internal control is defined as a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations.

Internal control is a means, in which an organization’s resources are directed, monitored, and measured. It plays an important role in preventing and detecting fraud and protecting the organization’s resources, especially high-risk assets, such as cash, inventories and other properties that are prone to risk.

Big corporate business surely understands the critical importance of an effective internal control, but for a small business, these are the common bewails:

• We don’t need internal control for a small business like us.
• It is costly to spend the time/money necessary to maintain effective controls
• We do not have qualified personnel or the history to build a good internal control system
• People are desperate – and desperate people do desperate things – theft and embezzlement.

However, such concerns are not entirely true. Small businesses can still enforce certain internal controls effectively and efficiently. One test of a good internal control is how it will quickly detect a fraud if it fails to prevent it.

The following are practical ways on how to improve the internal control in your small business.

 

Identify high-risk areas

It is highly recommended that tight controls are must be observed in high-risk areas. Business owners should identify which business process or areas are at most vulnerable to fraud and theft. The following are the common areas which are vulnerable to fraudulent schemes in a business:

• Cash receipts and disbursements
• Payroll
• Customer credit and collections
• Purchasing and inventory storage
• Customer credit and collections

 

Separate duties

In high-risk areas, such as cashiering and inventory custody, separation of duties should be implemented wherever practical. Two or more personnel should be involved in the process of authorization, documentation, execution, custody, and recording of transaction. This is important so as to easily detect any concealment of a fraudulent act, as well as unintentional errors.

For example, you can set out a policy that under no condition that an accountant, a bookkeeper, or the controller of the business be given check-signing authority because this person can easily conceal fraud if he or she has check-writing authority.

Although separation of duties on a full-time basis may not be practical in a small business environment, consider the job-sharing approach. In job sharing, two or more employees are regularly assigned to one area of the business on alternate schedule. Each employee acts as a check on the other so that both use established methods and procedures. However, be aware that separations of duties or job sharing scenario are still susceptible to collusion which is harder to detect.

 

Be aware in changes of employee lifestyle & behaviour

Keep watch on the lifestyles and behaviours of your employees without violating their privacy. As business owners, you know the salaries of your own employees, so you should be able to estimate what sort of lifestyles they can afford. As to their behaviour, any obvious actions that are unlikely from their daily activities will signify up to something. Whether for good or bad it is better to verify the cause of such actions.

It is also advisable, to perform background checks on all employees whether newly hired or not, especially those that will handle money and work in the high-risk fraud areas of the business.

 

Try surprise audit and inspection

Conduct surprise counts, inspections, and reconciliations that employees can’t anticipate or plan for. Any persons doing these surprise audits should be independent of the employees who have responsibility for complying with the internal controls. Surprise audits and inspections are very useful. It is very useful in uncovering any existing errors or irregularities within the organization.

 

Encourage whistleblowing

Here you have to involve your trusted employees to become whistleblowers. However, you should also ensure their protection, like by ensuring their anonymity and making sure that favouritism will be avoided inside the organization. You should see to it that relationships within your organization will be intact. Most employees have already built good and deep relationships with each other within the workplace. That is why it may be hard for them to become whistleblowers and report their friend co-workers to the management for some irregularities. To better implement whistleblowing within your organization, you may hire third parties to become the channel of confidential information.

 

Continuously leave audit trails

Good audit trails must be observed for all transactions. Documentary evidences must be well-presented for proving irregularities in your internal control. That is why you should ensure that the documentation and the process of recording economic transactions in your business will leave a clear path or document source for tracing, tracking and documenting purposes. They should also be organized and should be retained for a reasonable period of time.

 

Small business owners may not afford to hire internal auditors, but there are alternative ways to improve the internal controls. It is also true that in some cases, very good internal controls are established by a small business but they do not carry it out properly or internal control procedures are done only for compulsory manner. Nevertheless, as business owners, you should not tolerate such a laid-back attitude toward internal controls implementation within the business.