To reduce your risks, you need to identify them first. Sounds simple enough, but many private companies don’t make risk assessment a priority. A top-down risk assessment anchors your understanding of risk from a high-level perspective, enabling you to allocate resources toward designing and implementing controls that focus on what matters most to your business. Since your risks will change over time, it’s best to revisit and update the assessment regularly.

Which risks have the greatest potential impact on your business? Those should be your highest priorities when it comes to mitigation. In some cases, you may find that manual processes are creating risks that could be reduced or managed by moving to automated systems.  

There are various frameworks for establishing internal controls, and it’s important to choose one that best represents your operational, financial reporting, and compliance objectives. The COSO (Committee of Sponsoring Toggle #11. Organizations) framework is commonly used since it provides useful guidance on how to establish internal controls throughout an organization.

The best internal controls are a combination of preventive and detective—ensuring you take a proactive approach to heading off problems, while having reliable processes to detect them early. Typical controls might include performing accounts payable reconciliations and fluctuation analyses on payments and accruals or conducting periodic reviews to ensure compliance with contractual requirements related to timeliness, deliverables, and key performance indicators (KPIs).  

By dividing responsibility for key tasks among multiple staff members, you eliminate the risk that results when one person has full control of a transaction. Typically, this involves separating custodial duties (the keeping of the asset), authorization/approval duties, and recordkeeping duties. It’s best to institute sufficient review layers, with documents reviewed by someone who is more senior than the person who prepared them. And beyond separating duties at the individual level, it’s prudent to do so at the functional level—for example, not allowing the sales department to authorize its own team’s commissions.

Financial transaction approvals and authorizations are typically high-risk processes, so be sure your controls limit these tasks to employees with the right level of authority. 

If you keep cash or check stock on hand, store it securely and limit access to it. It’s equally important that your internal controls safeguard sensitive, proprietary, or confidential data.

Complete, accurate, timely records are critical to a thriving, profitable business. Robust internal controls can ensure your recordkeeping will enable your management team and investors to monitor the company’s progress with confidence. 

Everyone responsible for implementing your internal controls will need to understand exactly how. That’s why you need to develop documentation that’s complete, detailed, clear, and easy to access, understand, and follow. But internal control documentation doesn’t need to be an exhausting exercise; in fact, it’s likely your company is already doing many of the things that constitute good internal controls. You just need to put in writing what you’re doing, in a way that’s clear and repeatable. 

Everyone on your staff who will use your new internal controls or whose work could be affected by them needs proper training on how to implement or adhere to them consistently and effectively.

A good monitoring program ensures your team is adhering to your internal controls and they are working as they should. It’s usually a combination of an internal audit plan and management testing. Besides establishing an ongoing monitoring system, it’s best to work with an experienced finance partner to audit your controls periodically—not only to ensure your team is complying, but to spot issues and identify opportunities to improve and optimize controls.