Internal and external audit systems provide companies with a method for testing internal controls, a process that can help detect or prevent fraud while making sure the company stays compliant, stops misappropriation of assets and corrects bad reporting. So it’s surprising that so many companies don’t have one in place.
“For many companies, a lack of an audit system reflects a perceived lack of time,” says J.W. Wilson, CPA, director of audit and accounting services at Clarus Partners. “That smaller companies don’t have the time or resources to implement an audit system, however, is a misconception.”
Smart Business spoke with Wilson about audit systems, their purpose, types and basic implementation.
Why might some companies not have an established audit system?
Often the term ‘audit’ conjures up the idea of large companies with full-time staffers whose only job is to conduct audits. Companies don’t need employees devoting significant time to an internal audit system for an audit to be effective. The process can be scaled down to focused processes any company can effectively manage. In fact, many business owners are likely already performing many audit functions, just without calling it an internal audit process.
There’s also the perception that audits performed by outside agencies are expensive and the value might not match the price. Companies most likely don’t need a top-to-bottom audit. They can have testing done that is designed to look for a specific process, which is very affordable.
What are the steps to putting an audit system in place?
Companies should start by talking with the experts that are closest to them. For instance, someone in the company may have an internal audit background and may be capable of establishing internal audit procedures. If not, talk with an external accounting firm. Auditors from an outside agency can be brought in to gauge the effectiveness of a company’s controls, or can offer advice on how to set up an internal audit process.
Testing can be fairly basic — for example, select and follow a transaction through the accounting cycle to a general ledger, compare the findings to those of the previous month and budgeted numbers, and if the numbers don’t match, a formal investigation should be undertaken.
When determining personnel processes, the top priority is segregation of duties, especially around handling cash and assets. Payroll is a good example. Within this function, the person who processes payroll shouldn’t be the same person who adds employees to the payroll system. Similarly, the person who initiates disbursements and transfers shouldn’t be the same person doing bank reconciliations.
At the end of each month, it should be standard practice to review financial statements and compare them to the previous month and the budget or forecasting statement to see if they meet expectations. Monthly statements should reflect what’s been budgeted. If not, what was the reason? Look into any unexpected results that don’t have a justification.
Ultimately a company needs to have the right controls in place and then test those controls. Run a random internal audit to test that the segregation of duties is being maintained. That can be done though a company’s accounting system. Each system has controls and rights associated with logins, so it’s possible to check to see that the segregation of duties is being maintained.
How can a company determine the best approach to setting up an audit system?
It’s important to understand that every company is different, so one company’s control procedures aren’t necessarily going to fit another company’s processes. Just focus on a few key procedures — those that may expose the company to the most risk of fraud — and make sure those processes are monitored and tested regularly.
The term audit shouldn’t be frightening. Efficient internal controls are important, no matter the type or size of the company. Internal and external controls can be scaled to fit a company’s specific needs. And if setting up an audit process is far outside the wheelhouse of anyone in the company, consider working with an accounting firm to test specific controls that are important to the business.
Insights Accounting is brought to you by Clarus Partners
