Questions That Your Accountant Should Be Asking You-Internal Control

In this economy, there are a lot of desperate people who are just barely surviving. Thus it is not surprising that Small Business Fraud has steadily increased. Unfortunately, Small Business owners are most vulnerable to being the victims of fraud, especially check fraud. Because fraud can be a "one and done" occurrence, i.e., the company does not survive the loss, it important that your Accountant should be asking you the following questions:

1. Do you reconcile your bank account on a monthly basis?

Banks have a limit on how long that they will correct errors, thus the sooner that you can find possible errors, the better. Also, you don't want your Bookkeeper reconciling the bank account because he or she is making entries to the General Ledger bank account.

2. Is the bank statement sent to your home address?

If not, it should be. The reason is that you want to be the first to see the statement, so you can review the transactions. Ideally, you would also want to get copies of the cancelled checks, so you can see if any have been forged or altered.

3. Is your Bookkeeper reconciling the bank account or is he/she able to sign checks?

If so, this is a big NO! One of the major tenets of Internal Control is Segregation of Duties.
That is to say, you don't want one person to have physical custody of the asset (bank checks) and also record keeping responsibilty for that assset (bank checks). If there is no Segregation of Duties with regard to checks, it would be very easy for the Bookkeeper to alter checks, hide the forgery in the accounting records and steal money from you.

4. Have you set up Users on your Accounting software?

If you are using QuickBooks, I would highly recommend that Users be set up on QuickBooks.

This accomplishes two things:

                               You can identify who is making entries on QuickBooks.

                               You restrict employees to be only able to access certain parts
                               of the system, thus making it harder to commit fraud.

The last thing that you want is for everyone to have Admin permissions, because that means everyone can have access to the entire QuickBooks software and you can't identify who has done what.

5. Do you review the QuickBooks Audit Log and Deleted Transactions Report?

If you set up Users, you can use these reports to see who has made entries on the system.
In general, you don't ever want to delete transactions, because of fraud concerns. If a transaction is
deleted then you lose the information about that transaction.  A much better option is to Void entries. I would be very suspicious of someone who is deleting transactions.

6. Do you require that employees take mandatory vacations?

Most frauds require that the Fraudster not take a vacation because he/she needs to be present to keep the fraud going. However, in order for this control to be effective, employees must be cross trained on other jobs. Otherwise, if the Fraudster's work just piles up until he/she gets back from vacation, then the mandatory vaction control will not be effective.

I personally know of a situation where an employee was caught because he had to go on vacation.
In his absence, one of his fellow employees had to do his job. That employee saw some things that seemed kind of strange. Thus she reported it to Internal Audit. After investigation, it was determined that he had stolen $50,000. Thus he was tripped up because he had to go on vacation.

7. Do you have a Procedures Manaual?

If not, you should. If a key employee leaves all of a sudden, what would you do? Is their job documented so that someone else could step in?  How would the replacement be trained?

The last thing you want is to be totally dependent on one employee because no one else knows how to do their job.

As your company grows, it becomes necessary for the company to become more formalized to protect the company. Having strong Internal Control procedures can help protect your company.