Errors and fraud occur daily. Most private companies don’t pay enough attention to ensuring their accounting procedures will prevent or detect errors and fraud in the normal course of processing transactions.
Unfortunately, many companies are similarly not required by their owners or lenders to have a CPA firm audit their financial statements. Their accounting procedures are never reviewed for processing weaknesses that could lead to errors or fraud.
Auditing standards require that the auditor at least gain an understanding of the accounting procedures which are in place to detect and prevent errors and fraud. When accounting procedures are reviewed by a CPA and found to be poorly designed or not operating as planned, the auditor communicates the weaknesses to management so they can be corrected. Thus, an audit provides the opportunity to detect weaknesses in the accounting procedures.
However, even with audit analysis, errors and fraud continuously occur in companies of all sizes, even those that were audited. The objective of an audit of financial statements is not to detect errors and fraud but to certify that the financial statements are presented fairly in accordance with accounting standards.
If audited companies can still experience errors and fraud, what chance is there that errors and fraud are occurring at companies that have never been audited? Probably greater.
Private companies with no audit requirements often engage CPA firms to perform Review and Compilation services in order to prepare their financial statements in accordance with accounting standards. These services are structured to provide no review of accounting procedures or consideration of fraud. The engagement letter (contract) specifies that this is not included with these services.
Private companies need to ensure that they create accounting procedures that will detect errors and fraud. No system is fool proof, but the odds can be set in the company’s favor. Management must answer certain questions to help promote accountability and reduce errors and fraud.
By department, these are:
Sales- How does the company make sure that all sales are recorded? How do they make sure that all sales are made to customers within established credit limitations?
For manufacturing and distribution companies, management must make sure that all products shipped are invoiced. Someone should be responsible for checking that all products being shipped are included on the packing slips that relate to invoices that are generated upon shipment. For service companies, someone must determine that all time spent has been invoiced. Service time accounted for on time sheets or work slips must be controlled by someone who will determine that all time is billed.
There should also be a sales order system that requires credit limits for customers to be established and adhered to. Credit limits are the result of credit checks and past performance determined by management. There is a direct relationship between this process and bad debts.
Purchasing/Receiving/Payments- How does the company make sure it only pays for products and services that were properly ordered and received?
Most companies utilize a purchase order (PO) system to authorize and track purchases. Only vendors approved by management should be in the system. A periodic review of approved vendors should be made. It is important that the receiving department only accepts deliveries that were authorized by a PO and that quantities and products received agree to the PO. The receiving document or packing slip should contain an approval sign off by the receiving person who is held accountable.
In Accounts Payable, the critical procedure is to match a vendor invoice received to the PO and proof of delivery (packing slip or receiving document). A verified purchase can now be entered into the accounts payable system and be scheduled for payment. Unmatched invoices or receiving documents must be reviewed but not entered into accounts payable until matched.
When checks are drawn and submitted to an authorized signor, the signor should not sign the check unless the supporting documents are provided and reviewed. Only pay for goods received or services provided.
Cash Collections- How does the company make sure all customer collections are deposited into company accounts and posted to the correct customer?
In the accounts receivable department there should be one person who handles checks received and prepares the deposit slip and a different person that applies the collections to the customer accounts. If there is remote deposit using a check-scanning device, the person performing this task should not be the one to post the payments to the customer accounts. A lock box set up, where the customers mail their remittances directly to the bank and the bank provides customer collection information, can improve the control over cash collections.
Payroll- How does the company make sure that real employees are being paid the correct wages?
It is not the payroll processing company’s responsibility to know this. It is management’s responsibility to have procedures in place to set up employees on payroll with the correct rates of pay and then monitor changes. If wages are paid based on time spent, then there must be management approval of employee time submitted to payroll. Upon termination of employment, there have to be procedures to stop the payroll for those who have left on a timely basis.
Mail- How does the company know that mail will be distributed to the proper personnel?
Mail is the starting point of many transactions that will enter the company each day. It is important to have procedures in place that will prevent mail from being diverted from its proper destination. Collections of receivables, customer correspondence, vendor invoices, vendor correspondence, and many other items are received daily. Procedures need to ensure the mail reaches its proper destination. In a small company having the owner distribute or sort the mail will put all employees on notice that the owner may have seen what came in and look for it later on. This can be a deterrent to fraud.
Segregation of Duties- How does the company make sure that not only one person is involved with a transaction process?
When one person handles a complete transaction process, that person usually has the opportunity to commit fraud. If the same person that places orders and makes purchases also pays the bills for those purchases, that situation simplifies fraud.
To reduce errors and prevent fraud, all companies must answer these questions. If a company doesn’t need an audit, management should still consider engaging auditors to review the procedures in place, at least once. Internet and email transactions should also be scrutinized in the same manner. While errors and fraud methods continue to evolve, taking these steps will reduce your company’s risk profile significantly.
James M. Sausmer, CPA/ABV, CVA is a Partner with the Mazars USA LLP Entrepreneurial Services Group which focuses on closely held companies and family owned business. E-Mail [email protected].