Critical questions to ask about internal controls

Published January 29, 2020

  • Articles

When fraud strikes manufacturers, the effects can be devastating. The median fraud loss in the manufacturing sector was $240,000, according to the 2018 Report to the Nations published by the Association of Certified Fraud Examiners (ACFE). That’s almost double the median fraud loss for all industries ($130,000).

Internal controls are a company’s first line of defense in preventing and detecting fraudulent activity. How do your controls measure up? Proactive managers can ask these questions to evaluate whether their control systems are strong enough to help protect against theft or misstatement.

Is access to assets restricted?

Start by examining your company’s restrictions on physical access to assets. Employees should be able to access only those assets that are necessary to perform their jobs. Locks, security cameras and RFID tags can safeguard inventory in the warehouse. Encryption software and passwords can limit access to the accounting system and sensitive employee and customer data.

To help define who has access to what, conduct interviews and review formal job descriptions — if they’re available and accurate. In addition to outlining the scope of employees’ responsibilities, job descriptions should address the separation and duplication of sensitive duties.

For example, billing schemes are especially common among manufacturers. So, the person who’s responsible for billing customers shouldn’t also deposit customer payments and reconcile the accounts. When limited staff makes segregation of duties difficult, supervision and review is particularly important.

Are accounts reviewed by management?

One sign of strong controls is regular reconciliation and analysis of key accounts. Your company shouldn’t wait until year end to confirm account balances.

Monthly bank reconciliations and quarterly (or rolling) inventory counts may be appropriate. Strong internal control systems require management to review employees’ work — via test counts, recalculating mathematical computations or replicating tasks. Managers also should analyze account balances using variance analysis, common-sizing and breakdowns of sales by territory or product line to identify unusual trends.

Is your system protected from management overrides?

Frauds perpetrated by executives are the costliest. These frauds produce a median loss of $850,000 — nearly six times larger than the median loss caused by managers, and 17 times higher than the median loss caused by low-level employees, according to the latest ACFE report.

To help prevent fraud in the executive suite, hiring policies should include background checks and possibly supplemental screening, such as drug testing or psychological evaluations, on new hires. Executive expense reimbursement requests also warrant scrutiny. Often, fraud perpetrators use falsified expense reports to test internal controls. If successful in expense report fraud, they may graduate to bolder, costlier scams.

Are your financial statements audited?

Audits can help catch problems early, thereby minimizing fraud losses. They might be performed by an internal audit committee consisting of senior managers — though in many cases management is too busy with other responsibilities to perform this function. For this reason, many manufacturers hire external accounting professionals to audit their financial statements.

Keep in mind that external audits can unearth material irregularities and deter corruption, but they won’t necessarily detect immaterial frauds. In fact, no type of audit provides an absolute guarantee against dishonest employee behavior.

Are controls a priority?

For internal controls to be effective, your company needs to publicize them. You might, for example, offer training classes or publish articles in the employee newsletter to let everyone know that internal controls are a priority and that serious consequences await perpetrators.

Management should communicate fraud reporting mechanisms, such as anonymous hotlines. In addition, train managers to recognize possible red flags, including unusual journal entries and employees living beyond their means.

Lessons learned

Monitoring controls is a continuous improvement project to ensure they remain adequate and effective. The trick to preventing fraud is to stay one step ahead of would-be thieves.

Manufacturers with proactive controls — including thorough physical controls over assets, management review, account reconciliation and monitoring — can prevent or reduce the duration of schemes and their fraud losses.

For more information on reinforcing your controls, financial statement audits, or assistance with investigating suspicious activity, contact your MCM professional or reach out to Assurance Manager Kyle Jenkins via e-mail (kyle.jenkins@mcmcpa.com) or phone (812.670.3414).