Understanding Business Controls by Mwesige Emmanuel - HTML preview

PLEASE NOTE: This is an HTML preview only and some elements such as links or page numbers may be incorrect.
Download the book in PDF, ePub, Kindle for a complete version.

 

The need to understand Business Controls for Treasury and Finance Departments Prepared by Mwesige Emmanuel, Uganda. Emmanuel.mwesige@gmail.com

INTRODUCTION

In life there are always checks and balances to reduce the risk of loss, fraud and time management. We have checks and balances in our families, communities and the economy at large. Likewise businesses put in place checks and balances. In the business sense these are referred to as business controls.

Before we proceed to look at the different forms of business controls, let us take a moment and ask ourselves some of the following questions:

  1. What are business controls?
  2. Why are business controls so important for treasury and finance departments?
  3. When should we consider putting in place controls?
  4. When do internal controls become effective?
  5. How should the controls be managed?
  6. Which controls should be in place?

Let us now briefly look at the questions above.

What are business controls?

Business controls are procedures adopted in a business to safeguard its assets; ensure financial information is accurate and reliable, ensure compliance with all financial and operational requirements; and generally assist in achieving the business’s objectives.

Controls can as well be defined as methods put in place by a company to ensure the integrity of financial and accounting information, meet operational and profitability targets and transmit management policies throughout the organization.

Why are business controls so important for treasury and finance departments?

img1.pngBusiness controls are so important for treasury and finance departments for the following reasons: Effective business controls ensure thorough reporting procedures and that the activities carried out by the business are in line with the business’s objectives.

img1.png They also ensure the business’s physical and monetary assets are protected from fraud, theft and errors.

img1.png Additionally, business controls minimize the chance of unexpected events.

When should we consider putting in place controls?

There is no specific time when controls should be put in place. As a matter of fact, controls should be in place at all times and in all sections of the organization.

When do internal controls become effective?

Internal controls become effective only when employees follow them. Thus, if you want your company’s employees to carry out its internal control procedures, you must hire competent and trustworthy employees. Employees are the most important resource in a business but they are often taken for granted. When employees realize that they are not valued and their contribution in the company is not noticed, they can decide to sabotage the future of the company by intentionally refusing to adhere to the controls in place. When controls are not adhered to, loop holes are created and it is these loopholes that other parties take advantage of and siphon the company of its  resources and as such it can no longer be a going concern.

I recall a time when we had just been hired, we were taken through training and the company  policies were clearly communicated to us. Later on I found out that this was done to ensure that we get to know what is expected of us at the onset. For my case particularly, since I was part of the cash management team, we were strictly told never to make any cash disbursement before obtaining proper authorization from authorized managers. In fact, we were even furnished with a list of  people meant to approve documents for each department. This made the internal controls in place very effective and highly adhered to.

How should the controls be managed?

It is the responsibility of every individual in the company to manage the controls that relate to that particular department. However, separate committee, for instance an Internal Audit department or  an Internal Compliance section can be created to oversee the management of internal controls.

Which controls should be in place?

Different sections of Treasury and Finance Departments require different controls. For this reason, we shall look at the controls required in the following areas of finance and treasury department:

img2.png  Accounts payables

img2.png  Sales and Accounts Receivables

img2.png  Payroll

img2.png  Cash and bank accounts

img2.png  Non-current assets

img2.png  Stock

ACCOUNTS PAYABLES CONTROLS

Accounts payable controls are used to mitigate the risk of losses in the payables function. These controls can be for an entirely paper-based accounts payables system or a computerized accounts payables system as discussed below

Controls for an entirely paper-based accounts payables system

Though it may seem unlikely that some companies still use entirely paper-based systems to conduct their accounts payable processes, this is still the case for some smaller businesses. Even with a paper-based accounts payables system, there is a minimum set of controls needed to ensure that it operates properly. Some of the controls needed under an entirely paper-based accounts payables system are as below:

img2.png Manually review for duplicate invoices. A non-computerized accounting system has no way to automatically verify a supplier’s invoice number against the invoice number of invoices previously paid. Consequently, the payables staff must compare each newly received supplier invoice against invoices in two files: both those in the unpaid invoices file and those in the paid invoices file.

img2.png Conduct the three-way match. The payables staff must compare the pricing and quantities listed on the supplier invoice to the quantities actually received, as per receiving documents, and the price originally agreed to, as noted in the company’s purchase order. In summary, compare the invoice, Goods Received Note and Purchase Order t ensure accuracy.

img2.png Store payables by due date. The company must pay its bills on time, which calls for proper filing of unpaid supplier invoices by payment due date. Otherwise, suppliers can give the company a lower credit score or charge late fees. This control assumes that unpaid invoices will be stored based on the dates when the company can take early-payment discounts.

img2.png Check/Cheque stock from locked cabinet. Unused check/cheque stock should always be kept in a locked storage cabinet. In addition, the range of check/cheque numbers used should be stored in a separate location and cross-checked against the check/cheque numbers on the stored checks, to verify that no checks/cheques have been removed from the locked location.

img2.png Check signer compares voucher package to check/cheque. The check/cheque signer must compare the backup information attached to each check/cheque to the check/cheque itself, verifying the payee name, amount to be paid, and the due date. This review is intended to spot unauthorized purchases, payments to the wrong parties, or payments being made either too early or too late. This is a major control point for companies not using purchase orders, since the check/cheque signer represents the only supervisory-level review of purchases.

img2.png Perforate voucher package (Stamp the payment vouchers). The voucher package can be reused as the basis for an additional payment unless the package is perforated with the word “Paid” or some other word that clearly indicates the status of the voucher package.

img2.png Pre-number receiving reports. A key part of the three-way matching process is to ensure that the items being paid for have actually been received, and in the correct quantities. It is easier to ensure that all receiving reports are being transferred to the accounts payable department by pre- numbering the receiving reports and tracking down any reports whose numbers are missing.

img2.png Lock up blank receiving reports. If three-way matching is used, then the receiving report is considered evidence that the quantity of an item contracted for has arrived at a company location. If someone were to steal a blank receiving report, he or she could take the goods and still submit a completed receiving report, resulting in undetected theft. Consequently, it may be useful to lock up unused receiving reports.

img2.png Pre-number purchase orders. The purchase order is a key part of many accounts payable systems, since it provides the central authorization to pay. Consequently, if the purchasing  system is paper-based, it makes sense to keep track of the stock of purchase orders by pre- numbering them.

img2.png Lock up blank purchase orders. The purchase order represents a company’s official authorization to acquire goods and services. If someone could obtain blank purchase orders and fraudulently affix a company officer’s signature to it, that person could obligate the company to  a variety of purchases with relative impunity. Consequently, in cases where purchase orders are printed in advance, they should be stored in a locked cabinet.

img2.png Maintain a register of unapproved supplier invoices. If a company issues new supplier invoices to those empowered to authorize the invoices, then there is a significant chance that some invoices will be lost outside of the accounting department and will not be paid. To avoid this, update a register of unapproved supplier invoices on a daily basis, adding invoices to the register as they are sent out for approval and crossing them off the list upon their return. Any items remaining on the list after a predetermined time limit must be located.

img2.png Conduct a daily review of unmatched documents. The three-way matching process rarely results in a perfect match of all three documents (purchase order, receiving report, and supplier invoice), so these documents tend to pile up in a pending file. To keep the associated supplier payments from extending past early-payment discount dates or from incurring late-payment penalties, there should be a daily review of the pending file as well as ongoing, active measures taken to locate missing documents.

img2.png Reconcile supplier credit memos to shipping documentation. If a company negotiates the return of goods to a supplier, then it should deduct the amount of this return from any  obligation owed to the supplier. To do so, it should maintain a register of returned goods and match it against supplier credits. If no credits arrive, then use the register to continually remind suppliers to issue credit memos.

img2.png Only fund the checking account sufficiently to match outstanding checks. If someone were to fraudulently issue a check/cheque or modify an existing check/cheque, a company could lose a large part of the funds in its bank account. To avoid this, only transfer into the checking account an amount sufficient to cover the total amount of all checks/cheques already issued.

img2.png Destroy or perforate and lock up cancelled checks/cheques. Once a check/cheque is created, even if it is cancelled on the in-house accounting records, there is still a chance that someone can steal and cash it. To avoid this problem, either perforate it with the word “cancelled” and store it in a locked cabinet or shred it with a cross-cut shredder.

img2.png Add security features to check/cheque stock. A wide array of security features are available for check/cheque stock, such as watermarks and “Void” pantographs, that make it exceedingly difficult for a forger to alter a check/cheque. Since the cost of these features is low, it makes sense to add as many security features as possible.

img2.png Verify that all check/cheque stock ordered has been received. It is possible for both inside and outside parties to intercept an incoming delivery of check/cheque stock and to remove  some checks/cheques for later, fraudulent use. To detect such activity, always compare the number of checks/cheques ordered to the number that has arrived. Also, verify that the first check/cheque number in the new delivery is in direct numerical sequence from the last check number in the last delivery. In addition, flip through the check/cheque stock delivery to see if any check/cheque numbers are missing. Further, if the check/cheque stock is of the continuous feed variety, see if there are any breaks in the delivered set, indicating that some checks/cheques were removed.

img2.png Limit the number of check/cheque signers. If there are many check/cheque signers, it is possible that unsigned checks/cheques will be routed to the person least likely to conduct a thorough review of the accompanying voucher package, thereby rendering this control point invalid. Consequently, it is best to have only two check/cheque signers—one designated as the primary signer to whom all checks/cheques are routed and a backup who is used only when the primary check/cheque signer is not available for a lengthy period of time.

img2.png Restrict check/cheque signer access to accounting records, cash receipts, and bank reconciliations. The check/cheque signer is intended to be a reviewer of a nearly complete disbursement transaction, which requires independence from all the payables activities leading  up to the check/cheque signing for which this person is responsible. Consequently, the check/cheque signer should not have access to cash receipts, should not perform bank reconciliations, and should not have access to any accounting records. It is best if the check/cheque signer is not even a member of the accounting department and is not associated with it in any way.

img2.png Never sign blank checks/cheques. Though an obvious control, this should be set up as a standard corporate policy, and reiterated with all check/cheque signers.

img2.png Separate disbursement and bank account reconciliation duties. If a person involved in the disbursement process were to have responsibility for bank reconciliations, that person could improperly issue checks/cheques and then hide the returned checks/cheques. Consequently, always separate the disbursement function from the reconciliation function.

Controls for a Computerized Accounts Payables Environment

Computerization of the accounts payable process results in a number of efficiencies, though the overall process bears numerous similarities to the original paper-based system. Some of the controls needed under a computerized accounts payables environment are described as follows:

img2.png Automatic duplicate invoice number search. The accounting software automatically checks to see if a supplier’s invoice number has already been entered and warns the user if this is the case, thereby avoiding the need for manual investigation of potentially duplicate invoices.

img2.png Conduct three-way match. The payables staff must compare the pricing and quantities listed on the supplier invoice to the quantities actually received, as per receiving documents, and the price originally agreed to, as noted in the company’s purchase order.

img2.png Print report showing payables by due date. Since the computer system stores the invoice date and number of days allowed until payment, it can report to the user the exact date on which payment must be made for each invoice, thereby eliminating the need to manually monitor this information.

img2.png Check/cheque stock from locked storage. Unused check/cheque stock should always be kept in a locked storage cabinet. In addition, the range of check/cheque numbers used should be stored in a separate location, and cross-checked against the check/cheque numbers on the  stored checks/cheques, to verify that no checks/cheques have been removed from the locked location.

img2.png Check/cheque signer compares voucher package to check/cheque. The check/cheque signer must compare the backup information attached to each check/cheque to the check/cheque itself, verifying the payee name, amount to be paid, and the due date. This review is intended to spot unauthorized purchases, payments to the wrong parties, or payments being made either too early or too late. This is a major control point for companies not using purchase orders, since the check/cheque signer represents the only supervisory-level review of purchases.

img2.png Restrict access to the vendor master file. For a variety of reasons, it is unwise to allow unrestricted access to the vendor master file. Instead, use password access to restrict access to the smallest possible number of people, and only to those people who have no other responsibilities within the accounts payable and bank reconciliation areas.

img2.png Separate the supplier record creation and payment approval functions. A strong risk of fraud arises when the same person can create a supplier record in the vendor master file and approve payments to the same suppliers, since this person is capable of creating a fake supplier and approving payments to it. Instead, split these two responsibilities among different employees.

img2.png Use a standard naming convention to create supplier names in the vendor master record. Having multiple supplier records for the same supplier presents a problem when attempting to locate duplicate supplier invoices, since the same invoice may have been charged multiple times to different supplier records. One of the best ways to address this problem is to adopt a standard naming convention for all new supplier names, so that it will be readily apparent if a supplier name already exists. For example, the file name might be the first seven letters of the supplier name, followed by a sequential number.

img2.png Review daily changes to the vendor master file. An employee with access to the vendor master file could alter a supplier’s remit-to address, process checks/cheques having a revised address that routes the checks/cheques to him or her, and then alter the vendor master record again, back to the supplier’s remit-to address. If this person can also intercept the cashed check/cheque copy when it is returned by the bank, there is essentially no way to detect this type of fraud. The solution is to run a report listing all changes to the vendor master record, which includes the name of the person making changes. A second control that provides evidence of  this type of fraud is to only use a bank that creates an electronic image of all checks/cheques processed, so there is no way for an employee to eliminate all traces of this type of crime.

img2.png Require independent review of additions to vendor master file. To reduce the risk of  having an employee create a shell/fake company to which payments are made by the company, have a person not associated with the payables process review all additions to the vendor master file and confirm that they are acceptable prior to any payments being made. Under this  approach, only collusion that involves the reviewer will result in shell/fake company fraud.

img2.png Purge (clean up) the vendor master file. The vendor master file within the accounting software can become clogged with multiple versions of the same supplier information, if not regularly reviewed and cleaned up. Having multiple supplier records presents a problem when attempting to locate duplicate supplier invoices, since the same invoice may have been charged multiple times to different supplier records. The solution is to conduct a regularly scheduled review and purge of the vendor master file.

img2.png Run a credit report on every new supplier added to the vendor master file. A clear sign of fraud is when a shell/fake company is set up specifically to receive fraudulent payments from someone within the accounts payable department. By running a credit report on every new supplier, it is possible to see how long a supplier has been in business and investigate further as necessary.

img2.png Run a report listing identical remit-to addresses for multiple suppliers. Sometimes even the best manual review of the vendor master file will not detect all instances of duplicate  records, because the variety of names used for a single supplier may be widely separated within the vendor master file. A good way to spot this problem is to sort the vendor master file by remit-to address, which tends to cluster multiple instances of the same supplier close together in the report.

img2.png Match supplier addresses to employee addresses. Employees can create shell companies and fraudulently have checks/cheques sent to themselves. To detect this issue, create a computer report that matches supplier addresses in the vendor master file to employee addresses in the employee master file (assuming that the payroll function has also been computerized).

img2.png Reconcile supplier statements to payment detail. When a supplier’s monthly statement reveals that some payments are overdue, this can be evidence of a diverted payment by an employee. Consequently, the timely comparison of any supplier statements containing overdue payment notices to the vendor ledger in the computer system can be a good way to detect fraud. This control is also possible for a paper-based payables system, but requires considerably more review time, since payment records must be manually assembled for comparison purposes.

img2.png Access the vendor history file when paying from a copy. There is a greatly increased chance of duplicate payment when paying from a document copy, since the document original may already have been processed for payment. To mitigate this risk, always review the vendor history file to see if the same invoice number or an identical dollar amount has already been paid. An additional control is to require more approval signatures whenever a document copy is used.

img2.png Match quantities ordered to MRP requirements. When the purchasing department orders more materials than are required by the material requirements planning (MRP) system, this may represent fraud by the purchasing staff, which may be diverting the excess materials for their  own uses. Using the computer to match quantities ordered to actual requirements needed will spot this problem.

img2.png Match purchase order records to actual quantities received. If a company has a policy of paying the full amount of the purchase order if the delivered quantity is within a small percentage of the ordered amount, a canny supplier can continually short-ship deliveries by a small amount and never be caught. To detect this problem, run a computer report comparing the purchased amount to the delivered amount to see if there are any suppliers who have an ongoing pattern of delivering less than the ordered quantity.

img2.png Track changes in customer complaints related to suppliers. A supplier can improve its profits by selling low-quality goods to the company. Though this problem is difficult to detect, an indication is a sudden increase in customer complaints related to the materials provided by the supplier. Running a summary-level report itemizing customer complaints by supplier or type of complaint can spot this problem.

img2.png Track short-term price changes by suppliers. There is a possibility that suppliers will offer a kic

You may also like...