Basic internal control measures necessary for fraud prevention

Cyndy Elworth is a CPA and certified internal auditor with Kirkpatrick, Phillips & Miller CPAs, providing internal control and operational consulting services for companies.

Fraud is a widespread problem that affects practically every organization regardless of size, location or industry. Occupational fraud encompasses a wide range of misconduct by employees, managers and executives.

Since not all fraud is detected or reported, calculating the cost fraud imposes on the American economy is not possible. However, a recent survey conducted by the Association of Certified Fraud Examiners reported that fraud specialists in the United States estimated $600 billion will be lost in 2002 as a result of occupational fraud and abuse.

Of the eight fraud prevention measures the ACFE considered most helpful for organizations, survey participants chose strong internal controls as the most effective anti-fraud measure by a wide margin.

Do fraud schemes succeed because of a lack of controls, or do they succeed because controls which could have prevented the fraud are ignored? According to ACFE's 2002 Report to the Nation, approximately 46 percent of the time, fraud occurs in organizations that lack sufficient controls to prevent fraud and, 40 percent of the time fraud occurs because internal controls are ignored.

Forensic accountants and certified fraud examiners are aware that most companies have fraud, but lack adequate internal controls to prevent it. Companies themselves cite poor internal controls and management override of internal controls as the top two reasons why fraud is allowed to occur.

For these compelling reasons, an organization needs to understand the importance of the control environment, as it creates the structural foundation for the internal control components.

Business owners and managers play a key role in establishing a strong control environment. Internal controls are likely to function effectively if owners and managers believe those controls are important and communicate that view to employees at all levels. If management views the control structure as an obstacle to achieving objectives, employees will view internal controls as "red tape" to be "cut through" to get the job done.

While exceptions to established policies and procedures are sometimes necessary to accomplish a specific task, control overrides can pose a significant risk if not effectively limited.

Control activities are the policies and procedures established to help ensure management directives are carried out. Separation of duties is the most important control activity in the proper design of internal control. Separating the responsibility for physical custody of an asset from the related record keeping is a critical control.

Even small businesses with few employees can usually assign responsibilities to achieve adequate segregation. Direct oversight by the owner/manager can compensate for a lack of segregation of duties by signing checks, making bank deposits, reviewing bank statements and reconciliations, and monitoring duties.

Controls that ensure that only authorized employees can enter into transactions or have access to assets, documents and records are also important control activities.

Because organizations and personnel change, controls must be monitored regularly and over time to determine whether they continue to be relevant and effective. Monitoring activities can also reveal symptoms of fraud. Internal controls that are not monitored or tested are like gardens that are not weeded; they soon lose their purpose. Ongoing monitoring includes management and supervisory activities and other actions personnel take in performing their duties.

External parties can provide information and assist the organization in monitoring controls. For example, an internal auditing specialist can provide recommendations for improving controls based on an independent review and evaluation of an organization's internal controls over operations.

Another important aspect of monitoring is management's response to problems or suspected improprieties. If management follows up appropriately in those situations, it sends a signal that may discourage employees from considering fraud.

It is important to point out that adding too many controls or adding controls to prevent rare or unlikely events is costly and inefficient. The key is to balance cost and prevention. The cost of implementing a specific control should not exceed the expected benefit of the control.

Sometimes there is no out-of-pocket cost to establish an adequate control. A realignment duties may be all that is necessary to accomplish the objective.

In analyzing the pertinent costs and benefits, management also should attempt to identify and weigh the intangible and tangible consequences. For example, it may be difficult to determine the cost of poor public relations and lost goodwill if an ex-employee steals from an organization because the manager did not change the safe combination or retrieve an organization's keys upon an employee's termination.

Is your company at risk? Yes, all companies are at risk. Internal controls act like an insurance policy to prevent the best business plans from failing because of fraud. Being proactive can reduce your company's exposure to fraud.