1. Internal Controls

2. Professional Profile Karen Shenk, CPA, CVA, CFE Partner
Over 14 years of experience
Practice Areas:
Business Consulting
Business Valuations
Not-for-Profit Organizations
Audit & Attest Services
Agribusiness
Manufacturing & Construction Companies
Retail & Wholesale Companies
Real Estate Entities
Member of:
American Institute of Certified Public Accountants
Pennsylvania Institute of Certified Public Accountants
Association of Certified Fraud Examiners
National Association of Certified Valuation Analysts
Community Involvement:
SCORE Mentor
Treasurer – Power Packs Project
Karen Shenk, CPA, CVA, CFE
Partner

3. Agenda What are internal Controls
What is expected at each level of service
Required audit procedures
Management Letters
Internal Control Studies
Segregation of Duties Recommendations

4. Internal Controls Defined
Efficiency and effectiveness of operations.
Reliability of financial reporting.
Compliance with applicable laws and regulations.
Internal controls do not:
Prevent fraud and collusion
Guarantee accuracy

5. Levels of Service Compilation Review Audit Single Audit
Agreed-Upon Procedures
Internal Control Study

6. Required Audit Procedures
Walk-Throughs
Audit Procedures
What we do vs. test of controls
Management Letter

7. Management Letters Material Weaknesses Significant Deficiencies
Financial Statement Preparation
Significant Deficiencies
Other Recommendations (IT)

8. Management Letter Comments
Information should include:
Specific description of condition
Explanation of potential effects
Consider including potential magnitude
Brief description of the cause
Specific description of the recommended action

9. Management Letter Comments
Option #1:
During performance of the year end procedures, we noted that due to the limited size of the office staff, segregation of duties was limited in some processes. We noted several examples of a lack of segregation of duties in the following processes:
Option #2:
During performance of the year end procedures, we noted that, due to the limited size of the office staff, some duties that should be segregated are performed by the same individual. We have provided the following recommendations to improve separating incompatible duties in the following areas:

10. Management Letter Comments
Option #1:
We recommend that a summary of changes to employees be extracted and provided to the CFO on a regular basis and reviewed in detail. Any unexpected changes or variances should be reviewed with the Human Resources Director with any corrective action taken as necessary.
Option #2:
During our audit, we noted an opportunity for additional review of payroll reports. Unauthorized changes to employees and pay rates can go undetected without appropriate review of changes. We recommend that a summary of changes to employees be extracted and provided to the CFO on a regular basis and reviewed in detail. Any unexpected changes or variances should be reviewed with the Human Resources Director.

11. Internal Control Studies
Transactions:
Cash receipts
Cash disbursements for normal payables
Cash disbursements for inventory
Payroll
Information Technology

12. Internal Control Studies
Steps:
Obtain (or help the client prepare) a memo describing each transaction, including all exceptions/variations to the rule
Walk through each transaction, one for each exception/variation and document the process, completing the memo obtained in step 1
List each area where a control should exist but doesn’t, or where a control exists but isn’t always followed
Write comment for each area identified in step 3 (follow rules for management comments explained earlier)
Create an executive summary

13. Internal Control Studies
Ideal Entities:
Entities that have any level of service, especially those without an audit
Entities with few individuals in the accounting / finance department
Entities where the owner is not heavily involved in the accounting/finance department

14. Examples of Misappropriation of Assets
Financial Reporting Area
Asset Stolen
Type of Misappropriation
Cash
Stealing cash funds processed or on hand.
Not recording and stealing cash receipts.
Under-ringing sales and stealing cash receipts.
Altering bank deposits (for example, in “less cash” schemes).

15. Examples of Misappropriation of Assets
Financial Reporting Area
Asset Stolen
Type of Misappropriation
Accounts receivable, sales
Cash
Lapping.
Forging checks received.
Altering credit card receipts.
Granting credit for merchandise not returned and stealing the cash.
Writing off receivables as bad debts and stealing the cash received on the accounts written off.
Collusion between the buyer and seller to process refunds for goods not returned.

16. Examples of Misappropriation of Assets
Financial Reporting Area
Asset Stolen
Type of Misappropriation
Inventory, fixed assets
Stealing assets.
Selling assets and keeping the proceeds for personal use.
Setting up fictitious customers and shipping assets to them.
Diverting shipments to a wrong address.

17. Examples of Misappropriation of Assets
Financial Reporting Area
Asset Stolen
Type of Misappropriation
Accounts payable, purchases
Cash
Using organization checks to pay personal bills.
Setting up fictitious suppliers and “buying” goods or services from them.
Collusion between an employee buyer and seller in which the buyer receives a kickback for paying inflated prices, buying unneeded goods, or accepting inferior quality.

18. Examples of Misappropriation of Assets
Financial Reporting Area
Asset Stolen
Type of Misappropriation
Payroll
Cash
Setting up fictitious employees (ghost employees) on the payroll records and taking their pay.
Manipulating payroll records to divert wages or payroll taxes.
Overstating hours worked.
Working unauthorized overtime.
Cashing unused payroll checks.
Perpetrator writing payroll checks to self.
Embezzling payroll withholdings.
Keeping terminated employees on the payroll and diverting their pay.

19. Examples of Misappropriation of Assets
Financial Reporting Area
Asset Stolen
Type of Misappropriation
Borrowings
Cash
Unauthorized borrowing against organization assets.
Diverting loan proceeds for personal use.
Equity accounts
Diverting equity proceeds to personal use.
Underpaying dividends to certain investors and diverting the difference to personal use.
Selling shares of stock more than once.

20. Types of Controls Performance Reviews Independent Checks
Separation of Duties
Access and Authorization Controls

21. Types of Controls Performance Reviews Analyzing P&L
Compare to PY
Compare to Budget
Compare to Industry Standards
Analyzing Balance Sheet
Look for new accounts
Look for negative balances

22. Types of Controls Independent Checks Second check IT Validation
Employee rotation/vacation
Audits

23. Types of Controls
Separation of Duties
Recording
Authorizing
Custody

24. Cash Controls: Two-Person Office
Bookkeeper
Owner/Manager or President or CEO
• Record accounts receivable entries
• Mail checks
• Write checks
• Record general ledger entries
• Reconcile bank statements
• Record credits/debits in accounting records
• Receive cash
• Disburse petty cash
• Authorize purchase orders
• Authorize check requests
• Authorize invoices for payment
• Sign checks
• Complete deposit slips
• Perform interbank transfers
• Reconcile petty cash
• Process vendor invoices
• Review bank reconciliations

25. Cash Controls: Three-Person Office
Bookkeeper
Office Manager
Owner/Manager or President or CEO
• Record accounts receivable entries
• Reconcile petty cash
• Write checks
• Record general ledger entries
• Reconcile bank statements
• Record credits/debits in accounting records
• Process vendor invoices
• Receive cash
• Mail checks
• Approve invoices for payment
• Authorize purchase orders
• Disburse petty cash
• Sign checks
• Complete deposit slips
• Perform interbank transfers
• Review bank reconciliations

26. Cash Controls: Four-Person Office
Bookkeeper
Clerk
Office Manager
Owner/Manager or President or CEO
• Record accounts receivable entries
• Reconcile petty cash
• Write checks
• Record general ledger entries
• Reconcile bank statements
• Record credits/debits in accounting records
• Receive cash
• Disburse petty cash
• Authorize purchase orders
• Authorize check requests
• Mail checks
• Complete deposit slips
• Process vendor invoices
• Approve invoices for payment
• Sign checks
• Perform interbank transfers
• Review bank reconciliations

27. Payroll Controls: Two-Person Office
Bookkeeper
Owner/Manager or President or CEO
• Write payroll checks or prepare the direct deposit of payroll
• Record general ledger payroll entries
• Approve payroll
• Sign employee contracts
• Approve employee time sheets
• Sign payroll checks or authorize the direct deposit of payroll
• Distribute payroll

28. Payroll Controls: Three-Person Office
Bookkeeper
Office Manager
Owner/Manager or President or CEO
• Write payroll checks or prepare the direct deposit of payroll
• Record general ledger payroll entries
• Authorize employee timesheets
• Approve payroll
• Distribute payroll
• Sign employee contracts
• Sign payroll checks or authorize the direct deposit of payroll

29. Payroll Controls: Four-Person Office
Bookkeeper
Clerk
Office Manager
Owner/Manager or President or CEO
• Write payroll checks or prepare the direct deposit of payroll
• Record general ledger payroll entries
• Distribute payroll
• Approve payroll
• Sign employee contracts
• Approve employee timesheets
• Sign payroll checks or authorize the direct deposit of payroll

30. Types of Controls Access and Authorization Passwords
Limits (dual signatures > $X)
Dual Custody
Physical Safeguards (locked drawer, rooms, etc.)

31. How is occupational fraud initially detected?

32. Who reports occupational fraud?

33. Common Recommendations:
Fraud Hotline
Positive Pay
Lockbox
Review Bank Statements and Bank Reconciliations
Review changes to vendor and customer lists
Separation of Duties
Monitor relationships with customers and vendors
User access and changing passwords
Reviewing third-party SOC reports

34. Thank You