The last article discussed constraints in designing internal controls in smaller organizations. This section focuses on assessing the strength of internal controls. While there is no litmus test, there are several indicators of robust architecture.
Annual Financial Statement Audit
The first step performed by public accountants when working with a new audit client is to document internal controls, usually via flow-charting. This technique allows a visualization of key control tasks and identifies the people performing them. This process seeks to determine if employees are properly authorized, and if incompatible duties are separated (Segregation of Duties). At the conclusion of each audit engagement, the auditors provide a required SAS 114 letter to “Those Charged with Governance” – usually the Board or a Board Committee – to report important matters, especially material weaknesses (most severe), significant deficiencies and recommendations (least severe). The fewer findings within this report, the stronger the internal control environment.
The annual financial statement audit is designed to determine if the organization’s financial statements are free of material misstatement. This is separate and distinct from an assessment of internal controls that provide the basis for auditors to formulate an opinion on the accuracy of the financial statements. It may be a mistake to conclude that internal controls are acceptable solely based on receipt of an unmodified financial statement opinion.
Internal Control Assessments
If an organization is concerned about its internal controls, an external consultant can perform an assessment and make recommendations. However, these engagements are often expensive and disruptive. Alternatively, when organizations get to a certain size, they may establish an Internal Audit department which regularly examines internal controls on a risk-based rotation. However, the formation of an Internal Audit department is often far beyond the needs and means of small and mid-sized non-profits.
Treatment of Errors
Another indication of a strong internal control environment is determining the organization’s treatment of errors. When an error is discovered, how does the organization react? Errors can often be solved by a correcting general ledger journal entry. However, organizations seeking excellence will focus on the cause of an error as well, to determine if internal controls need to be modified. Subjecting errors to this type of scrutiny requires skill, time and deep institutional trust.
If your organization has SAS 114 findings, is confronting frequent accounting errors or is producing unclear financial reports, internal control shortcomings may be a factor. With decades of collective expertise in internal controls, we invite you to contact us for professional guidance.
Jane Repensek, CPA, MBA
Consultant