Thousands of possible controls can be used to ensure that a company maintains proper control over its assets. The following list represents the 14 most common controls found in most smaller organizations. These can be supplemented by additional controls in cases where the potential for loss of assets is considered to be exceptionally high, with the reverse being true in other instances.
The handling of cash is considered to be rife with control issues, resulting in perhaps an excessive use of controls. Although many potential controls are listed here, you should attempt to create a mix of controls that balances their cost against incremental gains in the level of control achieved:
- Compare check register to actual check number sequence. The computer’s list of checks printed should exactly match the checks that actually have been used. If not, this can be evidence that someone has removed a check from the check stock in hopes that it will not be noticed. This irregularity is most common for laser check stock, since these checks are stored as separate sheets and so can be more easily pilfered than continuous rolls of check stock.
- Conduct spot audits of petty cash. It is possible to misrepresent the contents of a petty cash box through the use of miscellaneous receipts and IOU vouchers. By making unscheduled audits, you sometimes can spot these irregularities.
- Control check stock. The check stock cannot be stored in the supply closet along with the pencils and paper, because anyone can remove a check from the stack and then is only a forged signature away from stealing funds from the company. Instead, the check stock should be locked in a secure cabinet, to which only authorized personnel have access.
- Control signature plates. If anyone can access the company’s signature plates, then it is possible not only to forge checks, but also to stamp authorized signatures on all sorts of legal documents. Accordingly, these plates should always be kept in the company safe.
- Deposit all checks daily. If checks are kept on hand for several days, there is an increased likelihood that someone will gain access to them and cash them into his or her own account. Consequently, bank deposits should be made every day.
- Divert incoming cash to a lockbox. If cash or checks from customers never reach a company, a host of control problems related to the potential misuse of that cash goes away. To do this, set up a lockbox that is controlled by the company’s bank, and ask customers to send their payments to the lockbox address.
- Limit petty cash reserves. If there is little money in a petty cash box, then there is less incentive for anyone to steal the box. If a large amount of cash volume flows through the box, a useful alternative is procurement cards.
- Reconcile petty cash. There tends to be a high incidence of fraud related to petty cash boxes, since money can be removed from them more easily. To reduce the incidence of these occurrences, initiate unscheduled petty cash box reconciliations, which may catch perpetrators before they have covered their actions with a false paper trail. This control can be strengthened by targeting those petty cash boxes that have experienced unusually high levels of cash replenishment requests.
- Require that petty cash vouchers be filled out in ink. Anyone maintaining a petty cash box can easily alter a voucher previously submitted as part of a legitimate transaction and remove cash from the petty cash box to match the altered voucher. To avoid this, require that all vouchers be completed in ink. To be extra careful, you can even require users to write the amount of any cash transactions on vouchers in words instead of numbers (e.g., “fifty-two dollars” instead of “52.00”), since numbers can be more easily modified.
- Perform bank reconciliations. This is one of the most important controls anywhere in a company, for it reveals all possible cash inflows and outflows. Carefully compare the bank statement’s list of checks cashed to the company’s internal records to ensure that checks have not been altered once they leave the company or that the books have not been altered to disguise the amount of the checks. Also compare the bank’s deposit records to the books to see if there are discrepancies that may be caused by someone taking checks or cash out of the batched bank deposits. Further, compare the records of all company bank accounts to see if any check kiting is taking place. In addition, it is absolutely fundamental that the bank reconciliation be completed by someone who is completed unassociated with the accounts payable, accounts receivable, or cash receipts functions, so that there is no way for anyone to conceal their wrong doings by altering the bank reconciliation. Finally, it is now possible to call up online bank records through the Internet, so that a reconciliation can be conducted every day. This is a useful approach, since irregularities can be spotted and corrected much more quickly.
- Separate responsibility for the cash receipt and cash disbursement functions. It is easy for a person with access to both the cash receipt and disbursement functions to commit fraud by altering the amount of incoming receipts and then pocketing the difference. To avoid this, each function should be handled by different people within the organization.
- Stamp incoming checks with “deposit to account number . . .” Employees with access to customer checks may try to cash them, as might anyone with access to the mail once it has left the company. This can be made more difficult by stamping the back of the check with “deposit to account number xxxxx,” so that they would have to deface this stamp in order to cash the check.
The shifting of investment funds is the area in which a person has the best chance for stealing large quantities of company funds or of placing them in inappropriate investments that have a high risk of loss. The next controls are designed to contain these risks:
- Impose investment limits. When investing its excess funds, a company should have a policy that requires it to invest only certain amounts in particular investment categories or vehicles. For example, only the first $100,000 of funds are insured through a bank account, so excess funding beyond this amount can be shifted elsewhere. As another example, the company owner may feel that there is too much risk in junk bond investments and so will place a general prohibition on this type of investment.
- Require authorizations to shift funds among accounts. A person who is attempting to fraudulently shift funds out of a company’s accounts must have approval authorization on file with one of the company’s investment banks to transfer money out to a non-company account. This type of authorization can be strictly controlled through signatory agreements with the banks. It is also possible to impose strict controls over the transfer of funds between company accounts, since a person may uncover a loophole in the control system whereby a particular bank has not been warned not to allow fund transfers outside of a preset range of company accounts and then shift all funds to that account and thence to an outside account.
Accounts Receivable Control
Controls are needed in the accounts receivable area to ensure that employees do not take payments from customers and then hide the malfeasance by altering customer receivable records. Here are the most common controls:
- Compare checks received to applications made against accounts receivable. It is possible for an accounts receivable clerk with the dual responsibility of cash application to cash a check to his or her personal account and then hide evidence of the stolen funds by continually applying subsequent cash received against the oldest accounts receivable. You can spot this by conducting an occasional comparison of checks listed on the deposit slip for a given day to the accounts against which the funds were credited.
- Confirm receivables balances. To check whether an employee is falsely applying cash from customers to different accounts in order to hide the loss of some cash that he or she has extracted from the company, periodically send out confirmation forms to customers to verify what they say they have paid to the company.
- Match invoiced quantities to the shipping log. It is useful to spot check the quantities invoiced to the quantities listed on the shipping log. By doing so, you can detect fraud in the billing department caused by invoicing for too many units, with the accounting staff pocketing the difference when it arrives. This is a rare form of fraud, since it generally requires collaboration between the billing and cash receipts staff. The control is needed only where the fraud risk clearly exists.
- Require approval of bad debt expenses. A manager should approve any bad debt write-offs from the accounts receivable listing. Otherwise, it is possible for someone to receive a check from a customer, cash it into his or her own account, and write off the corresponding account receivable as a bad debt. This control can be greatly enhanced by splitting the cash receipts function away from the collections function, so that collusion would be required to make this type of fraud work.
- Require approval of credits. It is possible for someone in the accounts receivable area to grant a credit to a customer in exchange for a kickback from the customer. You can prevent this by using approval forms for all credits granted, as well as a periodic comparison of credits granted to related approval forms. It is acceptable to allow the accounting staff to grant very small credits in order to clean up miscellaneous amounts on the accounts receivable listing, but these should be watched periodically to see if particular customers are accumulating large numbers of small credits.
- Verify invoice pricing. The billing department can commit fraud by issuing fake invoices to customers at improperly high prices and then pocketing the difference between the regular and inflated prices when the customer check arrives. Having someone compare the pricing on invoices to a standard price list before invoices are mailed can spot this issue. This form of fraud is possible only when there is a risk of collaboration between the billing and cash receipts staff, so the control is only needed when the fraud risk is present.
A company’s inventory can be so large and complex that extensive controls are needed simply to give it any degree of accuracy at all. Consequently, virtually all of the next controls are recommended to achieve a high level of inventory record accuracy:
- Conduct inventory audits. If no one ever checks the accuracy of the inventory, gradually it will vary from the book inventory, as an accumulation of errors builds up over time. To counteract this problem, you can schedule either a complete recount of the inventory from time to time or else an ongoing cycle count of small portions of the inventory each day. Whichever method is used, it is important to conduct research in regard to why errors are occurring, and attempt to fix the underlying problems.
- Control access to bill of material and inventory records. The security levels assigned to the files containing bill of material and inventory records should allow access to only a very small number of well-trained employees. By limiting access, you minimize the risk of inadvertent or deliberate changes to these valuable records. The security system should also store the keystrokes and user access codes for anyone who has accessed these records, in case evidence is needed to prove that fraudulent activities have occurred.
- Pick from stock based on bills of material. An excellent control over material costs is to require the use of bills of material for each item manufactured and then require that parts be picked from the raw materials stock for the production of these items based on the quantities listed in the bills of material. A reviewer then can hone in on those warehouse issuances that were not authorized through a bill of material, since there is no objective reason why these issuances should have taken place.
- Require approval to sign out inventory beyond amounts on pick list. If a standard pick list is used to take raw materials from the warehouse for production purposes, it should be the standard authorization for inventory removal. If production staff members require any additional inventory, they should go to the warehouse gate and request it, and the resulting distribution should be logged out of the warehouse. Furthermore, any inventory that is left over after production is completed should be sent back to the warehouse and logged in. By using this approach, the cost accountant can tell if there are errors in the bills of material that are used to create pick lists, since any extra inventory requisitions or warehouse returns probably represent errors in the bills.
- Restrict warehouse access to designated personnel. Without access restrictions, the company warehouse is like a large store with no prices—just take all you want. This does not necessarily mean that employees are taking items from stock for personal use, but they may be removing excessive inventory quantities for production purposes, which leads to a cluttered production floor. Also, this leaves the purchasing staff with the almost impossible chore of trying to determine what is in stock and what needs to be bought for immediate manufacturing needs. Consequently, a mandatory control over inventory is to fence it in and closely restrict access to it.
- Review inventory for obsolete items. The single largest cause of inventory valuation errors is the presence of large amounts of obsolete inventory. To avoid this problem, periodically print a report that lists which inventory items have not be used recently, including the extended cost of these items. A more accurate variation is to print a report itemizing all inventory items for which there are no current production requirements (possible only if a material requirements planning system is in place). Alternatively, you can use a report that compares the amount of inventory on hand to annual historical usage of each item. With this information available, you should then schedule regular meetings with the materials manager to determine what inventory items should be scrapped, sold off, or returned to suppliers.
Prepaid Expenses Control
The largest problem with prepaid expenses is that they tend to turn into a holding area for payments that should have been converted into expenses at some point in the past. There is also a potential for advances to be parked in this area that should have been collected. The next controls address these problems:
- Reconcile all prepaid expense accounts as part of the month-end closing process. By conducting a careful review of all prepaid accounts once a month, it becomes readily apparent which prepaid items should now be converted to an expense. The result of this review should be a spreadsheet that itemizes the nature of each prepaid item in each account. Since this can be a time consuming process involving some investigative work, it is best to review prepaid expense accounts shortly before the end of the month, so that a thorough review can be conducted without being cut short by the time pressures imposed by the usual closing process.
- Require approval of all advance payments to employees. The simplest way to reduce the burden of tracking employee advances is not to make them in the first place. The best approach is to require management approval of any advances, no matter how small they may be.
Fixed Assets Control
The purchase and sale of fixed assets require special controls to ensure that proper authorization has been obtained to conduct either transaction and also to ensure that the funds associated with fixed assets are properly accounted for. All of the next controls should be implemented to ensure that these goals are achieved:
- Compare capital investment projections to actual results. Managers have been known to make overly optimistic projections in order to make favorable cases for asset acquisitions. This issue can be mitigated by conducting regular reviews of the results of asset acquisitions in comparison to initial predictions and then tracing these findings back to the initiating managers. This approach can also be used at various milestones during the asset construction to ensure that costs incurred match original projections.
- Ensure that fixed asset purchases have appropriate prior authorization. A company with a capital-intensive infrastructure may find that its most important controls are over the authorization of funds for new or replacement capital projects. Depending on the potential amount of funding involved, these controls may include a complete net present value (NPV) review of the cash flows associated with each prospective investment as well as multilayered approvals that reach all the way up to the company owner or board of directors. A truly comprehensive control system will also include a post-completion review that compares the original cash flow estimates to those actually achieved, not only to see if a better estimation process can be used in the future but also to see if any deliberate misrepresentation of estimates was initially made.
- Verify that fixed-asset disposals are properly authorized. A company does not want to have a fire sale of its assets taking place without any member of the management team knowing about it. Consequently, the sale of assets should be properly authorized prior to any sale transaction being initiated, if only to ensure that the eventual price paid by the buyer is verified as being a reasonable one.
- Verify that cash receipts from asset sales are properly handled. Employees may sell a company’s assets, pocket the proceeds, and report to the company that the asset actually was scrapped. This control issue can be reduced by requiring that a bill of sale or receipt from a scrapping company accompany the file for every asset that has been disposed of.
Accounts Payable Control
This is one of the most common areas in which the misuse of assets will arise, as well as the one where transactional errors are most likely to occur. Nonetheless, an excessive use of controls in this area can result in a significant downgrading in the performance of the accounts payable staff, so a judiciously applied blend of controls should be use:
- Audit credit card statements. When employees are issued company credit cards, there will be some risk that the cards will be used for non-company expenses. To avoid this, you can spot check a few line items on every credit card statement, if not conduct a complete review of every statement received. For those employees who have a history of making inappropriate purchases but for whom a credit card is still supplied, it is also possible to review their purchases online (depending on what services are offered by the supplying bank) on the same day that purchases are made and alter credit limits at the same time, thereby keeping tighter control over credit card usage.
- Compare payments made to the receiving log. With the exception of payments for services or recurring payments, all payments made through the accounts payable system should have a corresponding record of receipt in the receiving log. If not, there should be grounds for investigation into why a payment was made. This can be a difficult control to implement if there is not an automated three-way matching system already in place, since otherwise a great deal of manual cross-checking will be needed.
- Require approval of all invoices that lack an associated purchase order. If the purchasing department has not given its approval to an invoice, then the accounting staff must send it to the supervisor of the department to whom it will be charged, so that this person can review and approve it.
Current Liabilities Control
The general area of current liabilities is one in which items can inadvertently build up over time when they should be charged to expense. The next controls impose close monitoring over the most common current liability accounts:
- Include an accrual review in the closing procedure for bonuses, commissions, property taxes, royalties, sick time, vacation time, unpaid wages, and warranty claims. There are many possible expenses for which an accrual is needed, given their size and repetitive nature. This control is designed to force a continual review of every possible current liability as part of the standard monthly closing procedure, so that no key accruals are missed.
- Review accrual accounts for un-reversed entries. Some accruals, such as unpaid wage accruals and commission accruals, are supposed to be reversed in the following period, when the actual expense is incurred. However, if an accountant forgets to set up a journal entry for automatic reversal in the next period properly, a company will find itself having recorded too large an expense. A simple control point is to include in the period-end closing procedure a review of all accounts in which accrual entries are made, to ensure that all reversals have been completed.
- Create standard entries for reversing journal entries. As a continuation of the last control point, an easy way to avoid problems with accrual journal entries that are supposed to be reversed is to create boilerplate journal entry formats in the accounting system that are preconfigured to be reversed automatically in the next period. As long as these standard formats are used, there will never be an un-reversed journal entry.
- Create a standard checklist of recurring supplier invoices to include in the month-end cutoff. A number of invoices arrive after month-end that are related to services and for which an accrual should be made. The easiest way to be assured of making these accruals is to create a list of recurring invoices, with their approximate amounts, and use it as a check-off list during the closing process. If the invoice has not yet arrived, then accrue for the standard amount shown on the list.
Notes Payable Control
The acquisition of new debt is usually a major event that is closely watched by the company owner, and so requires few controls. Nonetheless, the next control point is recommended as a general corporate policy:
Require supervisory approval of all borrowings and repayments. As was the case with the preceding control point, high-level supervisory approval is required for all debt instruments—except this time it is for final approval of each debt commitment. If the debt to be acquired is extremely large, it may be useful to have a policy requiring approval by the company owner or board of directors, just to be sure that there is full agreement at all levels of the organization regarding the nature of the debt commitment. To be a more useful control, this signing requirement should be communicated to the lender, so that it does not inadvertently accept a debt agreement that has not been signed by the proper person.
The key controls concern related to revenues is that all shipments be invoiced in a timely manner. A controls failure in this area can lead to a major revenue shortfall and threaten overall company liquidity:
- Compare all billings to the shipping log. There should be a continual comparison of billings to the shipment log, not only to ensure that everything shipped is billed but also to guard against illicit shipments that involve collusion between outside parties and the shipping staff. Someone who is handing out products at the shipping dock rarely will be obliging enough to record this transaction in the shipping log, so the additional step of carefully comparing finished goods inventory levels to physical inventory counts and reviewing all transactions for each item must be used to determine where inventory shrinkage appears to be occurring.
- Compare customer-requested delivery dates to actual shipment dates. If customer order information is loaded into the accounting computer system, run a comparison of the dates on which customers have requested delivery to the dates on which orders were actually shipped. If there is an ongoing tendency to make shipments substantially early, there may be a problem with trying to create revenue by making early shipments. Of particular interest is when there is a surge of early shipments in months when revenues would otherwise have been low, indicating a clear intention to increase revenues by avoiding customer mandated shipment dates. It may be possible to program the computer system to not allow the recording of deliveries if the entered delivery date is prior to the customer-requested delivery date, thereby effectively blocking early revenue recognition.
- Compare invoice dates to the recurring revenue database. In cases where a company obtains recurring revenue stream by billing customers periodically for maintenance or subscription services, there can be a temptation to create early billings in order to record revenue somewhat sooner. For example, a billing on a 12-month subscription could be issued after 11 months, thereby accelerating revenue recognition by one month. This issue can be spotted by comparing the total of recurring billings in a month to the total amount of recurring revenue for that period as compiled from the corporate database of customers with recurring revenue. Alternatively, you can compare the recurring billing dates for a small sample of customers to the dates on which invoices actually were issued.
- Investigate all journal entries increasing the size of revenue. Any time a journal entry is used to increase a sales account, this should be a “red flag” indicating the potential presence of revenues that were not created through a normal sales journal transaction. These transactions can be legitimate cases of incremental revenue recognition associated with prepaid services but can also be barter swap transactions or fake transactions whose sole purpose is to increase revenues. It is especially important to review all sales transactions where the offsetting debit to the sales credit is not accounts receivable or cash. This is a prime indicator of unusual transactions that may not really qualify as sales. For example, a gain on an asset sale or an extraordinary gain may be incorrectly credited to a sales account to mislead the reader of a company’s financial statements that its operating revenues have increased.
- Issue financial statements within one day of the period-end. By eliminating the gap between the end of the reporting period and the issuance of financial statements, it is impossible for anyone to create additional invoices for goods shipping subsequent to the period-end, thereby automatically eliminating any cutoff problems.
Cost of Goods Sold Control
There are many ways in which a company can lose control over its costs in the cost of goods sold area, since it involves many personnel and the largest proportion of company costs. The application of the next suggested controls to a production environment will rely heavily on the perceived gain that will be experienced from using them versus the extent to which they will interfere with the smooth functioning of the production department:
- Audit inventory material costs. Inventory costs usually are assigned either through a standard costing procedure or as part of some inventory layering concept, such as last in, first out or first in, first out. In the case of standard costs, you should regularly compare assigned costs to the actual cost of materials purchased to see if any standard costs should be updated to bring them more in line with actual costs incurred. If it is company policy to update standard costs only infrequently, then you should verify that the variance between actual and standard costs is being written off to the cost of goods sold.
- Compare the cost of all completed jobs to budgeted costs. A company can suffer from major drops in its gross margin if it does not keep an eagle eye on the costs incurred to complete jobs. To do so, the cost accountant should compare a complete list of all costs incurred for a job to the initial budget or quote and determine exactly which actual costs are higher than expected. This review should result in a list of problems that caused the cost overruns, which in turn can be addressed by the management team so that they do not arise again. This process should also be performed while jobs are in process (especially if the jobs are of long duration), so that problems can be found and fixed before job completion.
- Pick from stock based on bills of material. An excellent control over material costs is to require the use of bills of material for each item manufactured and then to require that parts be picked from the raw materials stock for the production of these items based on the quantities listed in the bills of material. By doing so, a reviewer can hone in on those warehouse issuances that were not authorized through a bill of material, since there is no objective reason why these issuances should have taken place.
Travel and Entertainment Expenses Control
Employee expense reports can involve dozens of line items of requested expense reimbursements, a few of which may conflict with a company’s stated reimbursement policies. In order to ensure that these gray-area expense line items are caught, many accountants apply a disproportionate amount of clerical time to the minute examination of expense reports. The need for this level of control will depend on the accountant’s perception of the amount of expenses that will be reduced through its use. In reality, some lesser form of control, such as expense report audits, are generally sufficient to keep expense reports “honest.”
- Audit expense reports at random. Employees may be more inclined to pass through expense items on their expense reports if they do not think that the company is reviewing their expenses. This issue can be resolved fairly inexpensively by conducting a few random audits of expense reports and following up with offending employees regarding any unauthorized expense submissions. Word of these activities will get around, resulting in better employee self-monitoring of their expense reports. Also, if there is evidence of repeat offenders, random audits can be made less random by requiring recurring audits for specific employees.
- Issue policies concerning allowable expenses. Employees may submit inappropriate expenses for reimbursement simply because they have not been told that the expenses are inappropriate. This problem can be resolved by issuing a detailed set of policies and procedures regarding travel. The concept can be made more available to employees by posting the information on a corporate intranet site. Also, if an online expense report submission system is in place, these rules can be incorporated directly into the underlying software, so that the system will warn employees regarding inappropriate reimbursement submissions.
Payroll Expenses Control
The controls used for payroll cover two areas: the avoidance of excessive amounts of pay to employees and the avoidance of fraud related to the creation of paychecks for non-existent employees. Both types of controls are addressed here:
- Require approval of all overtime hours worked by hourly personnel. One of the simplest forms of fraud is to come back to the company after hours and clock out at a later time, or have another employee do it on one’s behalf, thereby creating false overtime hours. This issue can be resolved by requiring supervisory approval of all overtime hours worked. A more advanced approach is to use a computerized time clock that categorizes each employee by a specific work period, so that any hours worked after his or her standard time period will be flagged automatically by the computer for supervisory approval. Such a system may not even allow an employee to clock out after a specific time of day without a supervisory code first being entered into the computer.
- Require approval of all pay changes. Pay changes can be made quite easily through the payroll system if there is collusion between a payroll clerk and any other employee. This problem can be spotted through regular comparisons of pay rates paid to the approved pay rates stored in employee folders. It is best to require the approval of a high-level manager for all pay changes, which should include that person’s signature on a standard pay change form. It is also useful to audit the deductions taken from employee paychecks, since these can be altered downward to effectively yield an increased rate of pay. This audit should include a review of the amount and timing of garnishment payments, to ensure that these deductions are being made as required by court orders.
A few continuing payments to suppliers are based on long-term contracts. Most of the next controls are associated with having a complete knowledge of the terms of these contracts, so that a company does not make incorrect payment amounts:
- Monitor when contracts are due for renewal. A company may find itself temporarily paying much higher prices to a supplier if it inadvertently lets expire a long-term contract containing advantageous price terms. To avoid this difficulty, a good control is to set up a master file of all contracts that includes contract expiration dates, so that there will be fair warning of when contract renegotiations must be initiated.
- Require approval for various levels of contractually based monetary commitment. There should be a company policy that itemizes the levels of monetary commitment at which additional levels of management approval are required. Although this step may not help the company to disavow signed contracts, it is a useful prevention tool for keeping managers from signing off on contracts that represent large or long-term monetary commitments.
- Obtain bonds for employees in financially sensitive positions. If there is some residual risk that, despite all the foregoing controls, corporate assets still will be lost due to the activities of employees, it is useful to obtain bonds on either specific employees or for entire departments, so that the company can be reimbursed in the event of fraudulent activities.
These recommended controls encompass only the most common problem areas. They should be supplemented by reviewing the process flows used by a company to see if there is a need for additional (or fewer) controls, depending on how the processes are structured. Controls will vary considerably by industry, as well; for example, the casino industry imposes multilayered controls over cash collection, since it is a cash business. Thus, these controls should be considered only the foundation for a comprehensive set of controls that must be tailored to each company’s specific needs.
Read also: Basic Control Systems And Types Of Fraud