Internal Controls - How to Stop Fraud before It Starts

Let's get started with understanding two basic definitions.

First is process.

This is how your organization captures data, changes data, and potentially introduces possible errors.

In plain English, this is how you go about doing something from start to finish.

For example, billing, depositing cash receipts, processing payroll.

Controls, on the other hand, are how you prevent, detect, and correct errors throughout the process.

Okay, let's go through a few examples.

In your cash receipts process, you receive payments from tuition, contributions, fee for services, and other revenue sources.

The process starts with your receipt of a payment from a customer, and it continues through the deposit process and the recording into the general ledger.

Processes can change over time due to technology or change in personnel.

The controls are the components of the process you put in place to reduce the risk of errors and fraud.

To develop your controls, you need to ask yourself what could go wrong and what controls do we have in place to mitigate or prevent an error or fraud.

Sticking to our cash receipts example, if the bookkeeper opens the mail, separates out the checks that needs to be deposited, prepares a deposit slip, goes to the bank and deposits the funds, records them in the general ledger, and at the end of the month also performs the monthly bank rec, You can see where this person could make an error or commit fraud, and it might go undetected.

Segregation of duties is a key component of internal controls.

It prevents or detects fraud when implemented properly.

Many of you may be saying, what if we don't have a large enough staff to truly segregate our fiscal duties? We'll address some of those compensating controls later in the episode.

Segregation of duties should divide up process responsibilities into three areas.

access, recording, and monitoring.

Access is who can touch the transaction.

In this case, who has access to the physical cash, checks, or other funds.

Recording is who posts the transactions into the general ledger.

And reconciliation is who is comparing what was deposited to what was recorded in the general ledger or who is performing the bank reconciliations.

If you can separate these three sets of duties, you will have a stronger set of internal controls.

Let's go through a few examples.

The person opening the mail, logging in all the checks, and stamping all the checks for deposit only before taking them to the bank, this is the person who has access.