Small Business Shared Interest Group

Expand all | Collapse all

The Challenge Of Internal Controls

  • 1.  The Challenge Of Internal Controls

    Posted 08-13-2024 09:33 PM

    I've noticed that small businesses face a unique challenge of implementing internal controls due to the availability of personnel to maintain day to day business operations. 

    In my company, top management are cross trained to operate in multiple roles to ensure business operations continue without interruptions. 

    What we do incorporate internal controls in our unique challenging environment are:

    #1. Roles are defined 

    #2. Policies and Procedures are in place 

    #3. Password Protected Logins w/ access to only authorized personnel and those who are cross trained are given Password Protected Logins w/limited access to only the areas that are essential to business functions.

    #4. Open lines of communication 

    #5. Documentation is required

    In a small business, it is too easy to blur the lines between roles. Small businesses need to maintain a reasonable assurance that ethics are being upheld, financial information is accurate, and company assets are protected from unauthorized usage. What other ways can small businesses with limited staff implement internal controls?



    ------------------------------
    Samuel Smith, MBA,CMA
    Controller/Office Manager/HR Manager
    Lovegreen Ford-Chrysler
    Kirksville, Missouri
    United States
    ------------------------------


  • 2.  RE: The Challenge Of Internal Controls

    Posted 08-13-2024 10:04 PM

    Implementing internal controls in a small business environment can indeed be challenging due to limited resources and personnel. However, through my experience leading national divisions at Synergi Partners and WebsterRogers LLP, I've seen firsthand how small businesses can effectively navigate these challenges.

    At Synergi Partners, where I led the national commercial tax strategy division, we prioritized clearly defining roles and responsibilities, ensuring that even in a lean environment, tasks didn't overlap and accountability was maintained. For example, we integrated detailed financial reporting and compliance procedures that were essential for passing SOC 1 and SOC 2 audits. This was particularly critical as we worked with clients in the SaaS and technology space, where accurate financial and operational analysis was non-negotiable.

    Similarly, at WebsterRogers LLP, during my tenure as the Senior National Division Lead, I engaged in multiple client assignments as an interim CFO and controller, where I focused on finance, operations, and technology. A key part of our success was developing and enforcing strict policies and procedures, training non-accounting personnel on the importance of these controls, and using technology such as ERP systems to streamline operations. This approach ensured that our small business clients maintained robust internal controls despite their size and resource constraints.

    • Role Definition
    • Policies and Procedures
    • Password Protection
    • Communication
    • Documentation


    ------------------------------
    Ilya Ilienko, dual MBA, CPA, CMA
    Board Member / Director
    East Coast - United States
    ------------------------------



  • 3.  RE: The Challenge Of Internal Controls

    Posted 08-13-2024 10:06 PM

    Great post Sir! @Samuel Smith



    ------------------------------
    Ilya Ilienko, dual MBA, CPA, CMA
    Board Member / Director
    East Coast - United States
    ------------------------------



  • 4.  RE: The Challenge Of Internal Controls

    Posted 08-14-2024 11:00 AM

    You're exactly right - limited staff at a small business has a tremendous impact on their ability to implement proper internal controls, specifically, segregation of duties.  If there are only one or two people in the accounting function, it makes it very difficult to properly separate incompatible duties such as posting of transactions and account reconciliations.  This makes monitoring and review controls even more important and puts more burden on management and owners/board members.  



    ------------------------------
    Amanda Bernard CMA,CPA,CFE
    Director/Manager
    Douglassville PA
    United States
    ------------------------------



  • 5.  RE: The Challenge Of Internal Controls

    Posted 08-14-2024 11:40 AM

    Important controls for small business are

    1. Separate financial duties
    2. Separate bank accounts
    3. Background checks on employees
    4. Inspect inventory regularly
    5. Implement access controls
    6. Restrict access to financial systems data
    7. Update password regularly
    8. Reconcile transactions
    9. Review credit card statements
    10. Compare receipts (matching receipts to purchases)

    How effective internal controls for small business depends on how they are implemented. Controls should be thoroughly documented, distribute control checklists and provide training and support to employees.



    ------------------------------
    Karen Gayle EA
    Accountant
    Bronx NY
    United States
    ------------------------------



  • 6.  RE: The Challenge Of Internal Controls

    Posted 08-14-2024 01:53 PM

    One issue with small businesses internal controls is the practice of hiring family members. Because they are family, there is a tendency to overlook yellow or even red flags. These employees need to be treated just like any other, including the hiring process and employee reviews. To help preserve familial relationships, I usually recommend NOT hiring family members despite the tax benefits if they are spouses or dependents.



    ------------------------------
    David Belnap, CMA, CSCA, CPA
    Belnap Accounting
    Hollywood FL
    United States
    ------------------------------



  • 7.  RE: The Challenge Of Internal Controls

    Posted 08-15-2024 09:31 AM

    I've worked almost exclusively with small/smaller businesses throughout my career.  It is especially important to pay attention to the fundamentals of internal controls.  Treating a small business with the same broad brush as a large business isn't advisable in my experience because it just isn't possible.  The leader - CFO, Controller, Fractional CFO is responsible for spot checks, mini audits, and consistent communication about the importance of good controls.  Those with mal intent will likely find a way to defraud.  It's the good people that run into hard times - deterring that is where it's at.



    ------------------------------
    Jason Sellnow CMA, CSCA
    ------------------------------



  • 8.  RE: The Challenge Of Internal Controls

    Posted 08-15-2024 10:56 AM
    Edited by Ilya Ilienko 08-15-2024 11:02 AM

    Hiring family members can definitely lead to some interesting dynamics in small businesses! It's true that overlooking potential issues just because someone is family can create blind spots in your internal controls. Back when I was at Synergi Partners, we made sure everyone was held to the same standards, whether they were related or not. We wanted to keep things fair and professional-plus, it made holiday dinners a lot less awkward!

    When you're working with small businesses, like I did at WebsterRogers LLP, it's clear that the standard internal controls used by larger companies just don't fit. You have to be creative and practical. I always pushed for regular spot checks and mini-audits, but let's be honest-nothing beats a good old-fashioned chat to remind everyone why controls matter.

    For those of us who've scaled companies quickly, we know that internal controls need to grow with the business. At Synergi, as we expanded, so did our checks and balances. We made sure everyone was on the same page, whether through audits or just keeping the lines of communication open.

    So, what have you all found works best when trying to balance strong internal controls with the day-to-day hustle of running a small business? Have any of you had to fire a family member? (Not that I'm asking for tips, but you know...just in case.) 

    @Patricia Stefanczyk @Michael DePrisco 



    ------------------------------
    Ilya Ilienko, dual MBA, CPA, CMA
    Board Member / Director
    East Coast - United States
    ------------------------------



  • 9.  RE: The Challenge Of Internal Controls

    Posted 08-16-2024 06:58 AM

    Good discussion. Have we done a webinar on this topic? Timely and relevant….



    ------------------------------
    Michael DePrisco
    Executive Officer
    West Chester PA
    United States
    ------------------------------



  • 10.  RE: The Challenge Of Internal Controls

    Posted 08-16-2024 11:40 AM
      |   view attached

    I agree @Michael DePrisco, its a very timely topic especially given the trajectory of small business and evolution of technology that may make small biz more vulnerable.

    Its something to look into, yes. Perhaps one of the Chapters, SIGs, or IMA learning channels can facilitate that. We definitely have enough talent to do so. Thanks for your input!!!

    Additionally, I'll post the response I received from our very own Steve McNally, CPA, CMA, MBA @J. Stephen McNally on LinkedIn regarding this:

    "Ilya Ilienko, dual MBA, CPA, CMA, thank you for initiating this discussion on the challenges of implementing internal control at small- and medium-sized businesses. The topic reminded me of an article I did for CFO (published October 2021) entitled "Small Business CFOs Must Build Ethical Awareness". As I shared in that article, CFOs and other finance and accounting leaders should take a leading role in building their organizations' ethical awareness and several practical ways to do so include setting the right tone at the top, defining your code of conduct, documenting key policies, segregating duties, and otherwise establishing tighter controls. Anyway, thank you for your leadership in IMA | Institute of Management Accountants's new Small Business SIG!"

    Steve's article is attached! Its excellent.



    ------------------------------
    Ilya Ilienko, dual MBA, CPA, CMA
    Board Member / Director
    East Coast - United States
    ------------------------------



  • 11.  RE: The Challenge Of Internal Controls

    Posted 08-16-2024 01:33 PM

    Thank You @Ilya Ilienko for sharing the article from @@J. Stephen McNally and everyone else for your contributions to the topic. I too am interested in webinars covering this topic. 

    More background in my interest in this topic, a few years ago my organization experienced a situation where we caught a manager improperly billing customers. Internal controls lacked in the situation along with a lack of staff to separate responsibilities, which through the situation the organization has learned to take internal controls more seriously. Policies and procedures were updated for all departments and staff roles were changed to improve internal controls. The manager was caught due to my department properly reporting the financials, which resulted in the receivables consistently growing each month, eventually the balance grew large enough that it prompted an investigation conducted by an officer that had no involvement in the situation. 

    Going forward, the officers and I meet each month to privately discuss the financial reports to determine if the numbers are inline with the performance reports that each department manager reported. 

    I've concluded through the learning experience that any small business can become very vulnerable to these unfortunate situations due to a lack of proper internal controls and due to a lack staff allowing for proper separation of roles and responsibilities.

    Excellent thoughts everyone!! 



    ------------------------------
    Samuel Smith, MBA,CMA
    Controller/Office Manager/HR Manager
    Lovegreen Ford-Chrysler
    Kirksville, Missouri
    United States
    ------------------------------



  • 12.  RE: The Challenge Of Internal Controls

    Posted 08-16-2024 03:21 PM

    Indeed @Samuel Smith its a great interesting topic.

    I appreciate you sharing and sparking a discussion.

    Lets see if anyone else had similar experiences or plain would like to delve further into internal controls and operation.

    Any fraud or risk stories anyone?



    ------------------------------
    Ilya Ilienko, dual MBA, CPA, CMA
    Board Member / Director
    East Coast - United States
    ------------------------------



  • 13.  RE: The Challenge Of Internal Controls

    Posted 08-17-2024 10:12 AM

    Happily, I don't have any good fraud stories, but a have a resource recommendation.

    Since becoming a member of the COSO Board for IMA, I've become familiar with the COSO Fraud Risk Management Guide (done in cooperation with ACFE).   It is a very readable document that was just updated in April 2023.   There is a free executive summary available on the COSO website for the Fraud Risk Management Guide, but the Guide itself must be purchased.

    The guide provides a great deal of insight into the differences between basic internal controls and controls designed to detect fraud.  The ACFE (Fraud Examiners) also do a survey every 2 yeara called the "Report to Nations" (the 2024 report was just released)that presents a good picture of the nature of fraud around the world.   It is available to anyone via the ACFE website.  If you are concerned with fraud, particularly by employees, it is well worth checking out.



    ------------------------------
    Larry White CMA,CFM,CSCA
    ------------------------------



  • 14.  RE: The Challenge Of Internal Controls

    Posted 08-18-2024 02:34 PM

    These are fantastic resources @Larry White

    Thank you!!! Really great for anyone in the community needing to reference, brush-up, or if involved in reviewing their internal controls in-house.



    ------------------------------
    Ilya Ilienko, dual MBA, CPA, CMA
    Board Member / Director
    East Coast - United States
    ------------------------------