As the owner of a business or non-profit you already know how busy your life is and how difficult it can be to handle the “must do’s” let alone the “should do’s”.  When someone mentions “internal controls” for the company you can feel guilty.  You know that it is good for you and the company yet there is no more time in the day.  Yet without reasonable internal controls the firm is susceptible to losses, theft and fraud.

There are some simple ways to create internal controls and not have the process take time away from your day.  What I will discuss below are my thoughts on protecting a generic firm.  To create specific controls for your company takes time to understand your processes and procedures, staffing, customers and business.  However, some of the following ideas may work immediately.

Whether you use an electronic bill payment system or mail out checks the first step in paying bills is ensuring that the bill/invoice is legitimate.   Someone (ideally you as owner) has to authorize or approve the invoice for payment.  If you cannot authorize payment of the bill it should be the controller/bookkeeper.  Second, the payments have to be entered into the bill payment system or the checks must be created.  This step can be handled by anyone else other than the person who approves invoices.

Third, the entries on the bill payment system must be reviewed, approved and sent.  If you are paying bills by check this person should review the check against the invoice before signing the check.  This should be you or the controller/bookkeeper but each of you should alternate performing the first and third steps.  In other words, if you as owner approves a bill to be paid then the controller would approve the bill payment entries or checks.  At no time should the same person handle both bill approval and bill payment/check approval.  Finally, bank transactions should be reconciled against your company records to ensure that they match.  If you are still receiving printed bank statements they should be mailed to your home address or held at the bank branch for you to pick-up.  If your bank statement is online it should be reviewed as soon as it is available.  One recommendation I made for this job was to have the owner’s oldest child (a high schooler) review the statement and get paid for it as a supplement to an allowance.  Catching any mistake elicited a one time “bonus” allowance as well.

Of course, anyone involved in the process of paying bills must take regular vacations without being involved in handling any aspect of bill payment.  While one person is on vacation a new person in the company should be trained to handle the job of the absent employee.  The newly trained person provides you back-up in case the first individual resigns or becomes ill for a length of time.  The new person must fully handle the job and leave nothing for the vacationer to complete when they return.  This is an excellent way to disrupt an embezzlement in process.  It is also wise to randomly switch people around in the paying bills process but they should not be given much prior notice.  Surprise moves facilitate my motto of Trust, but Verify.

The use of a third party, such as the owner’s child, works in some circumstances.  There are other third parties that can be your best friend when it comes to internal control.  For example, your outside accountant handles taxes and prepares your annual financial statement and quarterly reports.  The accountant can also review your internal controls annually and offer advice on best practices.  He or she can also discuss how other clients of the same size handle internal controls.

By the way, while an accountant can be an added expense they are an invaluable partner.  For example, if you have a need to borrow funds the financial institution will require recent financial statements.  You may be at a disadvantage if you cannot produce the quality information the bank needs from your in-house system.  Having an accountant who is up to date on your financial and tax condition could pay for itself if you need assistance quickly.

If you or your company has been a victim of fraud let me know if you are willing to discuss it with me. It would be helpful to others to hear about real life examples of fraud, loss and recovery.