Blogs
Best Practices to Fix Your Internal Controls
As the founder or leader of a private company, you aren’t required by regulations to have formal internal controls in place. But that doesn’t mean your business doesn’t need them!A proper internal control system is essential to running a viable, profitable business, whether you’re a public or private entity. Internal controls are the policies and procedures that help you manage and mitigate the financial and operational risks that can hinder your goals. Internal controls also ensure your financial data is accurate, reliable, and timely—so you can make informed decisions that optimize opportunities and build value.So while you aren’t obligated by regulators to have internal controls, if you intend to operate a thriving business then developing, implementing, and monitoring these controls is a must.Read more: Check out how Scrubbed can help you with Tax Compliance and Advisory Services Why Private Companies Need Internal ControlsAs a privately held company, you stand to gain a great deal by instituting internal controls—and conversely, you run the risk of losing a lot by not having them. Well-developed internal controls can help your business:Manage and mitigate financial risk as well as operational risk (for instance, failing to meet service level requirements per a customer contract)Ensure the integrity, completeness, and accuracy of the financial statements you use as key decision-making toolsOperate more efficiently, in part by avoiding costly, time-consuming errorsImprove consistency across the business, especially during times of high turnoverSafeguard confidential, sensitive, or proprietary dataReduce your operating costs over the long termJump-start your leadership team’s control consciousness, which will prove essential as the company growsComply with other regulations (unrelated to internal controls), such as those imposed by the IRS or other regulatory bodies Internal controls are also vital for satisfying investor requirements—both during the rigorous due diligence phase and ongoing. When potential investors evaluate your business, solid internal controls will give them confidence in your organization and the reliability of your financial statements. Once investors are on board, they’ll want to see evidence that you’re implementing these controls properly and consistently, providing them with the tools they need to monitor your company’s performance.Also read: Why Internal Controls are a Must for Small BusinessesBest Practices for Private Company Internal ControlsIf you’re ready to develop and institute the internal controls that can help you manage and mitigate risk, these 11 best practices can help you get started.1. Perform a top-down risk assessment.To reduce your risks, you need to identify them first. Sounds simple enough, but many private companies don’t make risk assessment a priority. A top-down risk assessment anchors your understanding of risk from a high-level perspective, enabling you to allocate resources toward designing and implementing controls that focus on what matters most to your business. Since your risks will change over time, it’s best to revisit and update the assessment regularly.2. Prioritize your risks.Which risks have the greatest potential impact on your business? Those should be your highest priorities when it comes to mitigation. In some cases, you may find that manual processes are creating risks that could be reduced or managed by moving to automated systems. 3. Choose your internal control framework.There are various frameworks for establishing internal controls, and it’s important to choose one that best represents your operational, financial reporting, and compliance objectives. The COSO (Committee of Sponsoring Toggle #11. Organizations) framework is commonly used since it provides useful guidance on how to establish internal controls throughout an organization.4. Develop controls to mitigate risksThe best internal controls are a combination of preventive and detective—ensuring you take a proactive approach to heading off problems, while having reliable processes to detect them early. Typical controls might include performing accounts payable reconciliations and fluctuation analyses on payments and accruals or conducting periodic reviews to ensure compliance with contractual requirements related to timeliness, deliverables, and key performance indicators (KPIs). 5. Separate critical duties.By dividing responsibility for key tasks among multiple staff members, you eliminate the risk that results when one person has full control of a transaction. Typically, this involves separating custodial duties (the keeping of the asset), authorization/approval duties, and recordkeeping duties. It’s best to institute sufficient review layers, with documents reviewed by someone who is more senior than the person who prepared them. And beyond separating duties at the individual level, it’s prudent to do so at the functional level—for example, not allowing the sales department to authorize its own team’s commissions.6. Tightly control approvals and authorizations.Financial transaction approvals and authorizations are typically high-risk processes, so be sure your controls limit these tasks to employees with the right level of authority. 7. Secure physical financial assets and data.If you keep cash or check stock on hand, store it securely and limit access to it. It’s equally important that your internal controls safeguard sensitive, proprietary, or confidential data.8. Improve your recordkeeping.Complete, accurate, timely records are critical to a thriving, profitable business. Robust internal controls can ensure your recordkeeping will enable your management team and investors to monitor the company’s progress with confidence. 9. Document your controls.Everyone responsible for implementing your internal controls will need to understand exactly how. That’s why you need to develop documentation that’s complete, detailed, clear, and easy to access, understand, and follow. But internal control documentation doesn’t need to be an exhausting exercise; in fact, it’s likely your company is already doing many of the things that constitute good internal controls. You just need to put in writing what you’re doing, in a way that’s clear and repeatable. 10. Provide thorough training.Everyone on your staff who will use your new internal controls or whose work could be affected by them needs proper training on how to implement or adhere to them consistently and effectively.11. Establish a controls monitoring system.A good monitoring program ensures your team is adhering to your internal controls and they are working as they should. It’s usually a combination of an internal audit plan and management testing. Besides establishing an ongoing monitoring system, it’s best to work with an experienced finance partner to audit your controls periodically—not only to ensure your team is complying, but to spot issues and identify opportunities to improve and optimize controls.
