5 Small Steps to Stronger Internal Controls

By Heather L. Brown

There are typically three factors that must be in place for fraud to occur: some form of pressure to commit a fraud, whether that be financially or psychologically driven; rationalization of the act, whereby the perpetrator is able to reconcile his actions with what society considers right or wrong; and opportunity to commit the act, whether real or perceived.

While there is often little an employer can do to address the pressure or rationalization components, an employer is able to exert tremendous influence over the opportunity to commit fraud. Regardless of the size of an organization, this component can be made to appear very small by implementing a few relatively simple steps.

References and Credentials

Any cat burglar will tell you that the best way to prevent them from getting the best of you is to simply prevent them from getting into your house. This philosophy applies to potential fraudsters as well. Checking references and credentials at the interview process is often a relatively simple process, but can go a long way toward minimizing the ability of a potential fraudster to join your organization. It would be highly unlikely that you would hire someone to manage your books if his last employer terminated him for stealing the escrow funds.

Code of Conduct

A code of conduct is basically a set of rules or standards outlining how employees are expected to act. Specifying appropriate and inappropriate behavior up front by including such a document in either the employee handbook, or by providing it to new hires at inception, goes a long way toward setting a positive “tone from the top” within the organization and can serve as a deterrent to potential fraudsters, especially if the document specifies at inception significant consequences for violation of the policies set forth therein. Samples of such policies can generally be obtained through a basic Internet search. Also, some human resource and payroll processing companies are able to provide sample statements as part of their existing service to an organization.

Training and Review

In addition to implementation of a code of conduct, the initial training of employees can be a tremendous opportunity to establish preventive controls and ward off potential fraud. By discussing established processes and procedures that new hires should follow in the performance of their job up front, management is able to ensure that employees are properly trained to comply with expected job duties. Additionally, by regularly reviewing employee performance and addressing issues where inappropriate conduct or improper procedures have occurred, management is able to establish that it is actively monitoring operations. Even the slightest perception of being monitored by management may serve as a deterrent against fraud.

Passwords and System Access

One of the most basic and yet most powerful controls that can be put into place by even the smallest of organizations is strong password and access controls. Just like the aforementioned cat burglar scenario, limiting access to specific programs and/or physical assets within an organization is a powerful deterrent for fraud. Even the most basic software packages can often be password protected to prevent unauthorized access. Limited authorization or access to online banking information, check stock or petty cash is often an obvious area for password protection. Additional preventative controls that many organizations find useful include “view only” access to customer account information and credit limits for sales personnel, “management only” access to the general journal function within the accounting software and limiting the ability of the receiving department to place or post orders within the accounting software. The less likely a perpetrator is able to cover up or conceal a fraud by accessing accounting records on both sides of a transaction, the less opportunity he may perceive to commit the act in the first place.

Walk the Talk

Regardless of the opportunities to strengthen controls noted above, if an organization does not enforce even the smallest of procedures and processes it has in place to deter fraud, it will fail to dissuade potential perpetrators. The perception of opportunity for fraud is just that … perception. An organization can have all the policies and procedures in place in the world, but if they aren’t enforced and/or routinely subject to override by management, they will offer little in terms of a deterrent. Many organizations have suffered tremendous frauds in the past due to bad hiring decisions, blatant disregard for the code of conduct amongst upper management, lack of follow-through on training or reviews, and ineffective IT security. For this reason, organizations who want to strengthen their controls must commit to follow through and “walk the talk.”. These procedures, while relatively simple, do require a commitment by the members of an organization to make them truly effective.

Unfortunately, in this day and age there are no guarantees that even with the implementation of procedures such as these, an organization will not become the victim of a fraudulent act. Companies with some of the best internal controls in the world have still found themselves vulnerable when it comes to preventing fraud within their organization. Ultimately, deterring fraud still comes down to a company’s “tone at the top” and how employees perceive management’s commitment to deter fraud.

About the Author
Heather L. Brown, CPA, CFE, is an audit manager with Kingery & Crouse, P.A., Certified Public Accountants, located in Tampa, Florida. During her 16-year tenure in public accounting, Heather has served a wide variety of clients, both public and private. Kingery & Crouse, P.A. is a full service public accounting firm with a staff of dedicated professionals providing audit (including SEC and employee benefit plan audits), tax and accounting services. You may contact Kingery & Crouse at (813) 874-1280 or find us on the web @ www.tampacpa.com.