You never think it’s going to happen in your business. After all, you trust your employees, and you want to believe everyone has the same interests at heart.
It’s exactly this common scenario that can leave many business owners shocked to discover evidence of internal fraud in their businesses. But fraud is widespread. In fact, according to research, businesses with fewer than 100 employees account for 22% of detected fraud cases, with a median loss of $150,000 and an average duration of 12 months.1 What’s more, the median loss can be outsized for these small businesses, at nearly twice the median loss for larger businesses.
As the old saying goes, however, an ounce of prevention is worth a pound of cure. Establishing and adhering to a system of strong internal controls is a proven way to protect your business and its assets. In addition to reducing fraud risk, a good system of internal control can strengthen business operations and make your operations more efficient and effective. Let’s look now at how internal controls can provide your business with a competitive advantage.
What are internal controls?
Simply put, internal controls are the specific procedures designed to protect an organization’s assets and help to prevent fraud—or detect it early. Think of them as checks and balances for internal processes, especially those that involve payments and reimbursements.
A well-designed system of internal controls goes beyond prevention, though. It helps a business create effective and replicable processes and comply with both internal policies and procedures and applicable laws and regulations (ultimately reducing the risk of costly fines and penalties).
There are two main types of internal controls:
- Preventive controls are implemented to prevent control failures from occurring in the first place.
- Detective controls are utilized to detect control failures if a failure does occur.
The first step to creating and implementing a system of strong internal controls is conducting a risk assessment. During this analysis, an analyst reviews existing processes (or lack thereof) in light of an organization’s control objectives in order to evaluate the design of existing control procedures and identify gaps in control procedures. Processes and risks are documented, along with the potential impact.
Four benefits of implementing strong internal controls
Implementing strong internal controls can give your business clear advantages, including:
- Standardization of functions. As your business grows or as staff come and go, it’s essential to have replicable, professionalized processes that can scale. Adding more employees or outsourced vendors can help you service more accounts and win more business, but it can also increase the risk of errors or internal fraud.
- Reduced risk. Mitigating risk through strong internal controls can help you protect your business assets and avert the costly consequences of internal fraud like asset diversion. In addition, reducing risk in this way helps ensure compliance with internal policies as well as external laws and regulations and can help you preserve good relationships with clients and vendors and protect your business’s reputation.
- Enhanced financial accuracy. Strong internal controls ensure that financial transactions and records are accurate and reliable. Accurate financial statements, in turn, help business owners make more informed decisions—and make it easier to prepare reliable financial statements and reports and meet compliance and reporting requirements.
- Improved operational efficiency. Strong internal controls provide clear guidelines and processes that help employees work smarter and with greater precision. This can reduce frustration while also improving organizational efficiency and productivity.
Examples of internal controls
Businesses often can benefit most from a strong system of internal controls to govern key transactions, including:
- Extending credit to customers. How creditworthy is that new prospective customer that wants to place a large order? Establishing a clear process for evaluating credit risk prior to extending credit helps your business to reduce its overall risk. Having defined procedures also helps communicate management’s risk tolerance to employees involved in credit decisions.
- Issuing vendor payments. Without a strong set of internal controls, vendor payments can be an area ripe for fraud. Create a system that includes vendor information, payment approval, and all relevant support, including invoice, packing slip, inventory receipt confirmation, and so on. Establish a protocol for responding to notifications—like an alert of a change in a vendor’s bank account—to reduce the risk of falling for a phishing scheme.
- Making expense reimbursements. Create a process to govern reimbursement requests from staff. Effective control requires evidentiary support for amounts to be reimbursed and appropriate manager approval. In addition, creating requirements for the timeliness of expense reporting and being cognizant of patterns in employee expense reimbursement requests may prevent potentially fraudulent requests before payout.
Implementing internal controls may seem like a tedious task, but it can confer significant advantages on your business. Every business, though, is unique, with its own specific staff, needs, and circumstances. Bringing in expertise in internal controls can help you put them in place at the right time the first time—so your business is protected.
When you are ready to implement strong internal controls, XPECT can help. XPECT professional services are designed to support the unique and specific needs of small and mid-size businesses. XPECT is focused on helping businesses optimize business strategy, enhance operational effectiveness, and successfully leverage accounting as a strategic tool, so that business leaders can focus on the strategic aspects of growing the business and achieving business goals. Learn more at www.xpectup.com.
1 Occupational Fraud 2022: A Report to the Nations, Copyright 2022 by the Association of Certified Fraud Examiners, Inc., p. 18, 29, https://legacy.acfe.com/report-to-the-nations/2022/.