What Are Internal Controls?
Internal controls are operating standards that a client uses to make sure the company runs well. The internal controls set in place for each type of financial account are structured differently. For example, an internal control for payroll would involve making sure that no fictitious (nonexistent) employees are getting paychecks.
One good internal control to avoid mistakes in payroll is to have a clear segregation between the department supervisors and those staff members responsible for personnel records and payroll processing. This type of operating standard is usually created by group effort: The board of directors, management, and internal control employees are all involved. (The board of directors usually consists of the corporation's president, vice president, treasurer, and secretary.)
If you're auditing a company in which a group of people — such as the board, management, and employees — design operating procedures, they create these rules to ensure four things:
The reliability of their financial statements
Protection of company assets
The effectiveness and efficiency of the business's operation
Compliance with laws and regulations, such as filing tax returns, maintaining a safe workplace, and protecting the environment from any hazardous byproducts of company operations
Internal controls are as important to management as they are to you. Management must have reliable financial information to make sound business decisions and safeguard its assets. In addition, how effectively and efficiently the business operates has a direct effect on the bottom line.
Regardless of the type of business you're auditing, you look for a few major hallmarks of internal control:
Segregation of duties: This is always the first characteristic of good internal controls because it provides a system of checks and balances. Having more than one employee work on a specific accounting task reduces the likelihood that an employee will skirt the accounting system and steal from the company.
In large companies, members of the board of directors usually aren't company employees. On the flip side, in some small companies, one person may be the company's sole shareholder and its only employee. In this case, you'd never have an effective internal control situation, because segregation of duties is lacking. The best you can hope for is that some sort of independent oversight exists — maybe by the person who prepares the company's tax return.
Written job descriptions: These descriptions should detail the duties and responsibilities for all employees and should be updated when an employee leaves or changes jobs.
Established levels of authority for performing certain tasks: For example, specific people must be involved when ordering equipment or writing off bad debt.
Periodic management testing and review: This procedure is essentially management's pledge to keep accurate accounting records and to make sure the company is compliant with internal controls.