Internal Controls

Professional Profile Karen Shenk, CPA, CVA, CFE Partner Over 14 years of experience Practice Areas: Business Consulting Business Valuations Not-for-Profit Organizations Audit & Attest Services Agribusiness Manufacturing & Construction Companies Retail & Wholesale Companies Real Estate Entities Member of: American Institute of Certified Public Accountants Pennsylvania Institute of Certified Public Accountants Association of Certified Fraud Examiners National Association of Certified Valuation Analysts Community Involvement: SCORE Mentor Treasurer – Power Packs Project Karen Shenk, CPA, CVA, CFE Partner Email: kshenk@troutcpa.com

Agenda What are internal Controls What is expected at each level of service Required audit procedures Management Letters Internal Control Studies Segregation of Duties Recommendations

Internal Controls Defined Efficiency and effectiveness of operations. Reliability of financial reporting. Compliance with applicable laws and regulations. Internal controls do not: Prevent fraud and collusion Guarantee accuracy

Levels of Service Compilation Review Audit Single Audit Agreed-Upon Procedures Internal Control Study

Required Audit Procedures Walk-Throughs Audit Procedures What we do vs. test of controls Management Letter

Management Letters Material Weaknesses Significant Deficiencies Financial Statement Preparation Significant Deficiencies Other Recommendations (IT)

Management Letter Comments Information should include: Specific description of condition Explanation of potential effects Consider including potential magnitude Brief description of the cause Specific description of the recommended action

Management Letter Comments Option #1: During performance of the year end procedures, we noted that due to the limited size of the office staff, segregation of duties was limited in some processes. We noted several examples of a lack of segregation of duties in the following processes: Option #2: During performance of the year end procedures, we noted that, due to the limited size of the office staff, some duties that should be segregated are performed by the same individual. We have provided the following recommendations to improve separating incompatible duties in the following areas:

Management Letter Comments Option #1: We recommend that a summary of changes to employees be extracted and provided to the CFO on a regular basis and reviewed in detail. Any unexpected changes or variances should be reviewed with the Human Resources Director with any corrective action taken as necessary. Option #2: During our audit, we noted an opportunity for additional review of payroll reports. Unauthorized changes to employees and pay rates can go undetected without appropriate review of changes. We recommend that a summary of changes to employees be extracted and provided to the CFO on a regular basis and reviewed in detail. Any unexpected changes or variances should be reviewed with the Human Resources Director.

Internal Control Studies Transactions: Cash receipts Cash disbursements for normal payables Cash disbursements for inventory Payroll Information Technology

Internal Control Studies Steps: Obtain (or help the client prepare) a memo describing each transaction, including all exceptions/variations to the rule Walk through each transaction, one for each exception/variation and document the process, completing the memo obtained in step 1 List each area where a control should exist but doesn’t, or where a control exists but isn’t always followed Write comment for each area identified in step 3 (follow rules for management comments explained earlier) Create an executive summary

Internal Control Studies Ideal Entities: Entities that have any level of service, especially those without an audit Entities with few individuals in the accounting / finance department Entities where the owner is not heavily involved in the accounting/finance department

Examples of Misappropriation of Assets Financial Reporting Area Asset Stolen Type of Misappropriation Cash Stealing cash funds processed or on hand. Not recording and stealing cash receipts. Under-ringing sales and stealing cash receipts. Altering bank deposits (for example, in “less cash” schemes).

Examples of Misappropriation of Assets Financial Reporting Area Asset Stolen Type of Misappropriation Accounts receivable, sales Cash Lapping. Forging checks received. Altering credit card receipts. Granting credit for merchandise not returned and stealing the cash. Writing off receivables as bad debts and stealing the cash received on the accounts written off. Collusion between the buyer and seller to process refunds for goods not returned.

Examples of Misappropriation of Assets Financial Reporting Area Asset Stolen Type of Misappropriation Inventory, fixed assets Stealing assets. Selling assets and keeping the proceeds for personal use. Setting up fictitious customers and shipping assets to them. Diverting shipments to a wrong address.

Examples of Misappropriation of Assets Financial Reporting Area Asset Stolen Type of Misappropriation Accounts payable, purchases Cash Using organization checks to pay personal bills. Setting up fictitious suppliers and “buying” goods or services from them. Collusion between an employee buyer and seller in which the buyer receives a kickback for paying inflated prices, buying unneeded goods, or accepting inferior quality.

Examples of Misappropriation of Assets Financial Reporting Area Asset Stolen Type of Misappropriation Payroll Cash Setting up fictitious employees (ghost employees) on the payroll records and taking their pay. Manipulating payroll records to divert wages or payroll taxes. Overstating hours worked. Working unauthorized overtime. Cashing unused payroll checks. Perpetrator writing payroll checks to self. Embezzling payroll withholdings. Keeping terminated employees on the payroll and diverting their pay.

Examples of Misappropriation of Assets Financial Reporting Area Asset Stolen Type of Misappropriation Borrowings Cash Unauthorized borrowing against organization assets. Diverting loan proceeds for personal use. Equity accounts Diverting equity proceeds to personal use. Underpaying dividends to certain investors and diverting the difference to personal use. Selling shares of stock more than once.

Types of Controls Performance Reviews Independent Checks Separation of Duties Access and Authorization Controls

Types of Controls Performance Reviews Analyzing P&L Compare to PY Compare to Budget Compare to Industry Standards Analyzing Balance Sheet Look for new accounts Look for negative balances

Types of Controls Independent Checks Second check IT Validation Employee rotation/vacation Audits

Types of Controls Separation of Duties Recording Authorizing Custody

Cash Controls: Two-Person Office Bookkeeper Owner/Manager or President or CEO • Record accounts receivable entries • Mail checks • Write checks • Record general ledger entries • Reconcile bank statements • Record credits/debits in accounting records • Receive cash • Disburse petty cash • Authorize purchase orders • Authorize check requests • Authorize invoices for payment • Sign checks • Complete deposit slips • Perform interbank transfers • Reconcile petty cash • Process vendor invoices • Review bank reconciliations

Cash Controls: Three-Person Office Bookkeeper Office Manager Owner/Manager or President or CEO • Record accounts receivable entries • Reconcile petty cash • Write checks • Record general ledger entries • Reconcile bank statements • Record credits/debits in accounting records • Process vendor invoices • Receive cash • Mail checks • Approve invoices for payment • Authorize purchase orders • Disburse petty cash • Sign checks • Complete deposit slips • Perform interbank transfers • Review bank reconciliations

Cash Controls: Four-Person Office Bookkeeper Clerk Office Manager Owner/Manager or President or CEO • Record accounts receivable entries • Reconcile petty cash • Write checks • Record general ledger entries • Reconcile bank statements • Record credits/debits in accounting records • Receive cash • Disburse petty cash • Authorize purchase orders • Authorize check requests • Mail checks • Complete deposit slips • Process vendor invoices • Approve invoices for payment • Sign checks • Perform interbank transfers • Review bank reconciliations

Payroll Controls: Two-Person Office Bookkeeper Owner/Manager or President or CEO • Write payroll checks or prepare the direct deposit of payroll • Record general ledger payroll entries • Approve payroll • Sign employee contracts • Approve employee time sheets • Sign payroll checks or authorize the direct deposit of payroll • Distribute payroll

Payroll Controls: Three-Person Office Bookkeeper Office Manager Owner/Manager or President or CEO • Write payroll checks or prepare the direct deposit of payroll • Record general ledger payroll entries • Authorize employee timesheets • Approve payroll • Distribute payroll • Sign employee contracts • Sign payroll checks or authorize the direct deposit of payroll

Payroll Controls: Four-Person Office Bookkeeper Clerk Office Manager Owner/Manager or President or CEO • Write payroll checks or prepare the direct deposit of payroll • Record general ledger payroll entries • Distribute payroll • Approve payroll • Sign employee contracts • Approve employee timesheets • Sign payroll checks or authorize the direct deposit of payroll

Types of Controls Access and Authorization Passwords Limits (dual signatures > $X) Dual Custody Physical Safeguards (locked drawer, rooms, etc.)

How is occupational fraud initially detected?

Who reports occupational fraud?

Common Recommendations: Fraud Hotline Positive Pay Lockbox Review Bank Statements and Bank Reconciliations Review changes to vendor and customer lists Separation of Duties Monitor relationships with customers and vendors User access and changing passwords Reviewing third-party SOC reports

Thank You