Five Myths About Internal Controls
As I was watching football over the holidays, I couldn’t help but notice the similarities between football teams and business organizations and was reminded of the importance that effective internal controls play in each of these organizations.
Similar to any sports team, a business organization’s objectives are best achieved when everyone involved is working toward a common goal. For monitoring this progress, a strong internal control structure is at the heart of all successful organizations.
To further analyze the significant role that internal controls play in an organization’s success, it is vitally important to first separate the myths from reality.
The Myths
Myth #1: Internal controls start with a strong set of policies and procedures.
A common belief is, “If our policies and procedures are detailed and cover all areas of our organization, our internal controls will be stronger.”
This school of thought is comparable to that of teams which believe, “The bigger our playbook, the better we’ll play.” This is obviously a misconception because time has shown that it’s not how many plays you run, but how well you execute the few plays you call. This concept begins with the attitude of those in charge—that is, the tone at the top.
While a strong set of policies and procedures is important, it is much more important that upper management set a proper example for the entire organization. If employees throughout the organization constantly witness upper management cutting corners, breaking rules, or taking the approach that the controls don’t apply to them, employees are much less likely to respect and comply with the controls in place.
On the other hand, if employees witness upper management repeatedly making the right choices and taking internal controls seriously, that attitude will trickle down to every employee throughout the organization.
Myth #2: Internal controls are a waste of “useful” time.
All too often, organizations have the impression that internal controls only hinder operations and make them inefficient. Whether or not it is the intention of management, it is important to note that lack of attention to internal controls can be interpreted as effectively saying they are not important.
Internal controls, when properly designed, can actually function as a mechanism to increase efficiency. Controls can provide vital information to management on a range of areas such as performance of employees and departments, duplication or proper assignment of work, achievement of goals and objectives, evaluation of the adequacy of final products, and error identification and correction.
In addition, for controls to be effective and efficient, they should not be built on top of current operations, but rather built into current operations. This will ensure that management has access to valid and vital information while not hindering the efficiency and progress of the organization and its employees.
Myth #3: That’s why we have auditors.
When working with new clients and trying to understand their internal controls, we always cringe when we hear them say, “We don’t worry about internal controls; that’s why we have auditors.”
In this situation, the organization either doesn’t have any controls or is simply unaware of the controls it actually does have in place. For the reasons mentioned in the first two myths, it cannot be stressed enough that internal controls are essential to any successful organization and that having a walk-through of your operations can help you identify these controls and put them to work for you.
While an audit can be a part of an organization’s risk management, it should not be the only control an organization relies on.
Myth #4: Internal controls are an “accounting thing.”
One of the most common attitudes we observe is that internal controls are an “accounting thing” and therefore don’t really apply to the rest of the company.
The purpose of internal controls is to ensure the achievement of an organization’s objectives in three categories: (1) operating effectiveness and efficiency, (2) reliable financial reporting, and (3) compliance with rules and regulations.
Organizations implement internal controls not only to prevent and detect fraud, but also to keep everyone in the organization on the same page. When the organization has specific procedures in place, employees know what they are accountable for and will hopefully have the tools at their disposal to utilize the internal controls to help the organization achieve each of the objectives noted above.
Myth #5: We’re too small to have internal controls.
Sometimes small organizations believe they are too small to have internal controls. However, as illustrated in the previous scenarios, internal controls are essential to a successful operation, and small organizations are no exception. Although the design of controls for small organizations will look different from the design of controls for large companies, internal controls are still able to provide the same benefits.
Let’s face it, having strong internal control policies and procedures in place at smaller organizations is tough, especially considering the limited staff and budgets available. Given that, small organizations must sometimes think “outside the box” when it comes to controls. For example, maybe a member of management reviews items on a rolling or random basis rather than 100 percent of the time (based on risk, of course). Or different board members are designated to review certain areas or reconciliations.
While it is difficult to achieve “perfect” internal controls in smaller organizations, you should not default to simply “punting” on internal controls altogether. Instead, take the mindset of getting the best “bang for your buck,” and really focus on making the controls you have in place work for you.
Conclusion
You might have heard this quote by one of football’s greatest coaches, Vince Lombardi: “The achievements of an organization are the results of the combined effort of each individual.” Now, I don’t imagine he had internal controls in mind when he delivered this quote, but the statement applies nonetheless.
If you’ve found yourself susceptible to these myths, try taking a new view of internal controls as a management tool. Then look at your operations to consider whether there are any areas where internal controls can be implemented or existing internal controls can be improved to help your organization achieve its overall goals.
