Financial Disease # 4
This is the 4th blog in a seven part series regarding common financial issues. In this series I have coupled a common known disease with a common financial issue. In three previous blogs, I discussed Cash Hemorrhaging, Financial Ebola and Costing Dyslexia. This week, I will share Financial Disease #4 Control Hepatitis.
Why are internal controls essential to businesses?
The fact is that small to medium sized businesses are a natural target for fraudulent schemes, scams, employee embezzlement, pilferage, worker crime and theft. Yet, small businesses typically have inadequate business controls. This is surprising, given the fact that they handle a lot of money, have valuable assets, and deal with a lot of people. This environment creates a perfect mix for bad things to happen to their business.
To protect against these threats, a small business should have a sound system of internal controls. Big business understands the critical importance of internal controls. Whereas, too many smaller businesses think they are exempt from these risks; because they feel that all their employees are honest and those they do business with are also honest. This results in their being too careless about internal controls. This makes them a target rich environment for the opportunists.
This common deficiency in internal controls I have labeled Control Hepatitis. Hepatitis according to the medical definition is an illness with an insidious onset, a hepatocellular pattern of injury and jaundice. Symptoms (if present) include fatigue, anorexia, nausea and right upper quadrant tenderness. If not properly treated or resolved it can result in acute liver failure and death. Coupling a businesses’ internal control illness with hepatitis we get the following description.
Is an infection that directly attacks the bottom-line. Often, a business with control hepatitis does not have any symptoms (business problems or signs of the disease). This failure to spot and correct control weaknesses is systemic in many small businesses. Unfortunately, a chronic infection can scar the bottom line. After, only a few years of infection it may cause cirrhosis. Frequently, those businesses developing cirrhosis will die.
Control Hepatitis is easily preventable if the business owner decides to address these hidden issues. For some, reviewing and implementing a system of common sense internal controls can be a daunting task. Where do I start, what do I look for? Below is an outline for a simple three step process to attack this systemic issue in small to mid-sized businesses.
Step 1 – Understand you existing system
Don’t worry, you don’t need to become an internal control expert. However, you should identify where you think there is risk. The three critical areas to examine are: cash momement, inventories & small asset control and high volume transactions. Then when you examine these activities you need to understand:
- First, who is responsible for key internal control points.
- Second, realize that when it comes to controls there are those that are nice to have, and some that are must have. Cash is a – must have. For example, timely, monthly bank reconciliations, reviews and approvals are essential. Dual signatures for all checks exceeding a pre-set amount. Never pre-sign blank checks. Ensure segregation of duties for cash movement.
- Finally, are your controls documented? If they are documented then review them for weaknesses or make sure that they are complete and have incorporated changing business practices over the years. If controls are not documented, then you need to document. If you establish a control philosophy and overarching purpose for controls it will go a long way into protecting your assets, improving operating efficiencies, and it will also serve as a job training aid for new employees.
Step 2 – Use a building-block approach
Use the five components of good internal control systems (control environment, risk assessment, control activities, information and communication, and monitoring activities) in order to break the project into workable pieces. Then focus on making sure the principles in each component are all operating together as they should. This requires a significant amount of judgment. Also, try to build off what is already in place. Do you need to refocus your approach, refine control processes or just update documentation?
Step 3 – Look for added value opportunities
A good system of internal controls is much more than compliance and risk reduction. Use this as an opportunity to find ways to improve effectiveness and increase the efficiency. One real life example, is that at one time in my career, I was working for one of the world’s largest oil companies. As part of my responsibilities I used to teach and was asked to conduct internal control reviews throughout the organization. What I usually found was there was too much control in 60% of the areas, but not enough control at the critical points. More control is not always the answer. The right controls at the right spot, can lower costs, improve efficiencies, remove unnecessary steps, reduce employee frustration and speed up the processes.
In summary, control hepatitis is an all too common illness within small to mid-sized companies. Controls do not have to be complicated or onerous. The fact is that companies that do have a good handle on their internal business controls have fewer problems, lower operating risks, and generally higher profits. Plus their owners sleep better at night.
Do you have the right mix of controls for your business needs?