Internal Controls for Small Businesses: Safeguarding Your Financial Health
Internal controls are essential mechanisms that help a business manage risks, ensure the accuracy of financial reporting, and comply with laws and regulations.
Many small business owners mistakenly believe internal controls don't apply to them or that they don't have a large enough staff to implement internal controls. However, internal controls apply to businesses of all sizes.
In this article, we'll explain what internal controls are, why they're essential, and provide some examples of how to establish a control environment in your small business.
What are internal controls?
An internal control is any procedure or practice designed to identify and prevent fraudulent actions, safeguard a company's assets, and ensure the reliability of its accounting records.
Of course, even with robust internal control systems, people can find ways to circumvent controls and commit fraud. However, strong internal controls help promote accountability and reduce risk to an acceptable level.
Your internal control framework may depend on manual controls, software, or both.
Why are internal controls essential to a small business?
For small businesses, internal controls are not just a formality; they are vital tools for survival and growth. According to the 2022 Association of Certified Fraud Examiners (ACFE) Report to the Nations, small businesses with fewer than 100 employees experience the highest median losses from fraud. For the smallest businesses, the median loss was $150,000, compared to $100,000 for businesses with 100-9,999 and $138,000 for businesses with more than 10,000 employees.
In other words, the businesses least able to weather huge financial losses from fraud are more likely to experience its devastating effects.
Small businesses are more likely to experience fraud (and not detect it until it's reached significant levels) because of their size. That's why setting up a system to prevent fraud, mitigate risks, and protect assets is crucial.
Internal controls help in:
Preventing fraud and errors. By having checks and balances, businesses can minimize the risk of errors and fraudulent activities.
Enhancing financial accuracy. Accurate financial reporting is crucial for making informed business decisions.
Ensuring compliance. With ever-changing regulations, internal controls help businesses stay compliant and avoid penalties.
Protecting assets. Controls are essential in safeguarding physical and intellectual assets from theft and misuse.
How to create an effective internal control system in your small businesses
You can implement control activities that improve operational efficiency even with a small accounting staff. Here are some ideas for establishing a system of internal controls in your organization.
Review bank and credit card reconciliations
Have your bookkeeper or accountant reconcile bank and credit card statements with the company’s records every month and review those reconciliations regularly.
Reviewing these reconciliations requires three items: the reconciliation itself, the bank or credit card statement, and canceled checks or images of all checks that cleared the account.
Ensure the statement comes directly from your bank or financial institution, not the person who performed the reconciliation. If the employee who prepares reconciliations is committing fraud, they can manipulate the bank statement or the cleared checks to cover it up.
Bank reconciliations should include a list of checks and the vendors the check was paid to. When reviewing the reconciliation, make sure you recognize all vendors and ensure the vendor name listed on the reconciliation matches the vendor on the cleared check. This helps identify potentially fraudulent disbursements.
Create a segregation of duties whenever possible
Segregation of duties means ensuring that no one person is responsible for all steps in a transaction or process. It builds checks and balances into your business processes to reduce the risk of fraud or errors.
Segregating duties in a small business can be challenging because you have fewer staff members, but here are a few examples of internal controls you can implement.
The person who purchases goods or services should not be the person who approves those purchases, records the transaction in the financial records, or has physical access to blank checks.
The person who reconciles accounts receivable shouldn't handle customer cash receipts.
Someone other than the bookkeeper or accounts receivable clerk should send monthly statements to customers.
Ensure the person signing the check is the one who will send it to the vendor.
Use direct deposits to reduce the risk of payroll fraud.
Review payroll calculations to spot if there are fictitious or terminated employees on the payroll.
If you use a point-of-sale system, require employees to log in so you can monitor who is on the register and count cash in the drawer at the beginning and end of each shift.
Inspect and count incoming inventory to ensure your orders are filled accurately.
Conduct periodic inventory and petty cash counts to ensure records match actual quantities.
Use passwords and access controls in your accounting software to protect sensitive financial data. Require employees to use unique and strong passwords and change them regularly.
Conduct background checks of employees whose job responsibilities include bookkeeping, accounting, payroll, or cash handling.
Require approvals before new employees can be added to the payroll.
Require employees involved in authorization, recording, reconciliation, or custody of assets to take annual vacations and have someone else handle their duties while they're gone.
Establish a maximum limit for expense reimbursements that can be submitted without a receipt. A standard cap is $20 to $25.
If employees make cash deposits, have another employee double-count the money first and check that amount against the deposit receipt.
Sometimes, it's necessary to have a single employee performing more than one role because you have a limited number of employees. In these cases, you or your accountant should compensate for this lack of segregation of duties by providing another level of insight. These are called compensating controls.
Ensuring compliance with internal controls
Establishing internal controls is the first step. However, effective internal controls must be monitored regularly to ensure employees still practice control activities and that the internal controls are performing as expected.
To ensure compliance:
Provide regular training. Educate your staff about the importance of internal controls and their specific roles.
Monitor and review. Regularly review and update control procedures to adapt to new risks, job duties, computer software, or changes in the business environment.
External audits. Many small businesses don't need audited financial statements. However, if you require an annual financial statement audit—to comply with loan covenants or contractual obligations, for example—part of the financial statement audit process involves understanding internal controls and testing for internal control deficiencies.
Establishing and maintaining strong internal controls can be challenging, especially for small businesses with limited staff and resources. At Slate Accounting + Technology, we understand these challenges. If you need assistance setting up effective internal controls or are considering outsourcing your accounting for enhanced segregation of duties, contact Slate. Our team of experienced accountants offers tailored bookkeeping and advisory services to help you safeguard your business’s future.