It is interesting to note that, in many cases, the internal control system at many companies consists of volumes of instruction-like procedures that document activities. If a company is taking the time and effort to develop a procedure-based financial control system, it’s worth the additional effort it takes to:

• Understand major financial processes;
• Establish key finance polices and goals (including performance goals and accurate financial statements);
• Determine which processes introduce the greatest amount of risk and which are material to our financial goals;
• Prioritize development of the internal control system according to materiality, risk, and other important criteria;
• Incorporate best practices; and
• Foster an environment in which continual improvement is the status quo.

Is there a better indicator of an effective system of controls than clear goals and key performance metrics that are consistently measured and regularly improving? And are you taking advantage of the financial control system to improve process results and your financial performance?

Easily Editable Procedure Templates for Internal Control


CFO Accounting Procedures Series

---

Accounting Procedures Manual

---

Financial Procedures Manual

Improving Processes in the Production Area and the Office

Discussions of process improvement and quality commonly reference the production area, or shop floor. Is it any less important for your other key office processes (for example, accounting and finance) to function effectively and efficiently? If you’re a service provider rather than a manufacturer, are quality and process improvement less material? (Of course not.)

How well does your company manage financial aspects like working capital, debt and investments, and leasing? These are as vital to a company’s success as efficient product design and production, yet few attempt to understand and improve finance processes to the same degree as, say, the product development process.

In fact, a lack of focus on finance is common, especially among privately-owned SMBs. Research shows that a majority of SMBs do not create capital plans, do not actively manage working capital, nor do they conduct analysis of financial statements.

Do you know if you’re making money on the cash you borrow? How about the assets you deploy, like accounts receivable, inventory, or cash? What about asset acquisitions you make? These are hard questions but they’re the kinds of questions you should be asking before you raise debt or equity capital.

What really represents the bigger threat to the success of your business:

• One of your Receivables staff borrowing 5-10 euros from petty cash when they’re short of cash and they want to go out to lunch on Friday? Or…
• Not having well-thought-out and consistent methods for managing high level finances that — if your financial situation suddenly and significantly worsened — could result in millions’ worth of losses?

The answer should be obvious.

A Financial Control System that Focuses on Improvement and Success

We’re not implying that businesses ought to ignore cash drawer controls. What we are suggesting is that focusing on low risk/low payoff components while neglecting key aspects doesn’t indicate a system of controls that appropriately addresses risk or that has its priorities in order.

Focusing on the mundane or trivial will do little to improve your overall financial performance! Internal control systems should be designed for continual improvement in key aspects of your operations, such as:

• Regularly reviewing and improving the overall capital structure;
• Using a capital plan to minimize the cost of capital while strengthening your debt/equity position;
• Managing working capital so excessive inventories and receivables do not sap your financial resources;
• Ensuring proper calculations and scenarios are explored while making debt & investment or leasing decisions; and
• Maximizing returns while minimizing costs for cash and merchant accounts.

A system of well-defined processes is not only about control or compliance: it is also about consistently striving to do a little better. Control systems that are designed only to achieve compliance are doing the bare minimum, which means they represent missed opportunities — opportunities to gain and keep a competitive edge, for instance.

That ought to be enough reason for any size and type of company to think about using the process approach to ensure continual improvement and an effective system of internal controls.

To help you build an effective system of internal controls for success, consider the Bizmanualz Finance Policies, Procedures, and Forms manual. Download a sample and see for yourself what companies like yours have saved in planning and development alone!

Accrual Method

The accrual accounting method is defined as the method of keeping accounts which shows expenses incurred and income earned for a given period, although such expenses and income may not have been actually paid or received in cash.  Hence, the financial statements show revenues and expenses, even before any such revenues or expenses are paid.

The accrual method is the more acceptable and the more widely used because it correctly matches the earning process to the activity.  In other words, revenue is recorded when services or goods are rendered or shipped, regardless of when paid.

Cash Method

The cash method of accounting is familiar to most individuals since personal income tax returns are filed on the cash basis.  As the name implies, revenues and expenses are only recorded when the consideration paid actually changes hands.  This could be months after the actual event occurred.

Many small business owners prefer the cash basis due to its simplicity and ease of understanding.  At the end of any given period, the recorded net income will agree more closely to the change in the business’s cash balance.  However, when requesting financing from any bank or agency, business owners are generally asked to furnish financial statements, prepared on the accrual basis.  Clearly any “stakeholders” want to see the true effect on the financial statements of activities, as they occur, as opposed to when they are paid.

Many small businesses (under $1,000,000 in sales) may use the cash basis method for filing business tax returns, even if the business keeps its books on the accrual basis.  In a growing business, income taxes can be deferred for a year for revenues recorded from increases in accounts receivables.

Percentage of Completion Method

The percentage of completion method is a variant of the accrual method, used for businesses with long term contracts, primarily construction contractors.  Instead of valuing revenues based on services invoiced, contractors will adjust the revenue billed to agree with the estimated percentage of the total contract that has been completed to date.

Reporting Standards

Many transactions are entered routinely through the accounting system without much concern about reporting standards.  However, other transactions can be handled in different ways depending on a person’s judgment over the facts and circumstances.  For example, if a business decides to lease an expensive piece of machinery, how should it record lease payments?  Perhaps they should be simply charged to lease expense.   Do you have a lease policy procedure? Your accounting policies should clearly state how to record leases.

However, maybe the terms of the lease imply an obligation and the payments represent a pay-off of that obligation.  In that case, a portion of the payment should be applied to the debt and the other portion charged to interest expense.

The resulting financial statements would look different in those two cases.  The usefulness of financial statements would be severely limited if their presentation was based solely upon the preparer’s judgment.  Consequently, certain standards must be agreed upon and followed.

GAAP – Generally Accepted Accounting Principles

There was no commonly agreed upon standardization over accounting practices for within past accounting systems until after the great depression of 1933.  In response to the vast sums lost by investors in the stock market crash, the Securities and Exchange Commission (SEC) was established and given authority to set accounting standards for publicly held corporations.

In an effort to stave off further government regulation, the accounting profession, organized under the American Institute of Certified Public Accountants (AICPA), issued its first auditing standards in 1939.  This began its attempt at self-regulation, though the AICPA continues to work with the SEC and defers to the SEC on regulatory reporting requirements for publicly held companies.

Between then and 1959 the AICPA issued 51 authoritative pronouncements known as Accounting Research Bulletins (ARB) that formed the basis of what became known as generally accepted accounting principles (GAAP).  From 1959 to 1973 the Accounting Principles Board (APB) issued 31 additional standards.

In 1973 a new full-time independent body, separate from the AICPA was created, called the Financial Accounting Standards Board (FASB).  This board has issued over 147 Statements of Standards by the end of 2002.  These standards, along with official interpretations, Accounting Research Bulletins (ARB), previously issued pronouncements, SEC rulings, industry guides, and other exposure drafts make up the current basket of generally accepted accounting principles.

The Matching Principle

Woven through all of the GAAP pronouncements are several universal principles.  One is the concept of matching.  Accrual and percentage of completion methods represent attempts to more properly match the financial statement presentation to the actual transactions that have occurred.  Revenues are matched to services performed and product sold, and expenses are matched to activities that have incurred expenses.  This is why accrual based reporting conforms to GAAP and cash based reporting does not.  The matching principle is a keystone of generally accepted accounting practice.

Conformity

Conformity is another widely used concept in accounting.  The method of implementing percentage of completion, for example, should be the same for all companies.  Only by practicing conformity will there be comparability.  Investors, lenders and business owners, could not properly evaluate the success of a particular business as compared to the rest of its industry, if all businesses used different methods for recording transactions.  Conformity is another fundamental principle in GAAP.

Valuation

A common consensus in GAAP reporting is the agreement that financial statements are valued on an historical basis.  This is an important concept that provides for consistent conformity.  As an example, real estate is valued at its original cost, not what it might be worth on an appraised value.

Accounting board pronouncements have continued to modify this principle to make financial reports even more conservative than historical basis, by requiring a downward adjustment, if the potential selling value has fallen below the original cost.

An example is inventory, when obsolescence reduces its value below its original cost. Another example is the yearly devaluing of fixed assets through depreciation.  Each year the original cost of a building or equipment is lowered by writing off a portion of its expected life and expensing it to depreciation.  Other assets like accounts receivable are reviewed and written down to their expected realizable value by charging off any amount deemed uncollectible to bad debt expense.

The overall attempt is to present financial statements on the most conservative basis possible.  The objective is to ensure that the net worth recorded on a company’s financial statements is never more than the true value of a company, based upon the lower of historical cost or the expected realized selling price of its assets minus its liabilities.

Events in the early years of the 2000′s have shown how important this objective is.  In spite of all the GAAP pronouncements in place, “creative accounting” techniques that push the gray areas of accounting valuation issues have resulted in significant, previously undisclosed impairments to the financial statements of companies like Tyco, Enron, and WorldCom.

Inventory Valuation

Inventory valuation is a specially treated area that deserves specific mention.  Inventory is always valued at the lower or cost or market (realizable value, net of selling costs).  However, cost can be determined in three different ways.

First In – First Out (FIFO) values the cost of inventory based on the principle that the first item purchased is the first item to be sold.  Visually, this method mimics a store owner’s method of stocking shelves by putting its most recent purchases at the back of the shelf, so that the older product is sold first.  Hence, the value of the amount of inventory on hand, always represents the cost of the very latest purchases.  In a true FIFO valuation, each purchase is tracked as a separate layer with its own cost.  Sales are also tracked and taken from one or more specific layers.

A variant on the FIFO method is the Average Cost FIFO method, which eliminates the need to keep track of separate purchasing layers.  The cost of each new purchase is added to the “pool” which changes the overall cost of the “pool”.  Sales are then taken from this single “pool”, leaving a value of the inventory on hand that closely resembles, but not necessarily equals, the value of inventory on a true FIFO method.

A final method of valuation is based on Last In – First Out (LIFO).  This is the opposite of FIFO: the last items purchased are deemed to be the first items sold.  This means that the ending inventory value is comprised of the very first items purchased.  This value could be lower than the FIFO value, particularly in inflationary times.

One might ask how two opposing methods of valuation could both be allowed under GAAP, particularly, when this would seem to violate the important principle of conformity.  This is one of many good examples of the challenge to create a consensus of opinion when there are several options, which have equal justification and support.  Accounting principles are not static laws handed down from the mountaintop, hence the term, “generally accepted”.

In this case, there is current justification and support for either method.  In deference to conformity, GAAP provides that financial statements valuing inventory on LIFO are to include a footnote reference, which discloses the valuation difference between LIFO and FIFO.  This is one of many compromises that provide conformity over different methods of valuation.

Materiality

A final important concept in all of GAAP is materiality.  Surprisingly, coming from a group of professionals known for their penchant for chasing down pennies, every pronouncement contains a materiality clause that allows for non-compliance in any area, if the effect on the financial statement presentation is clearly immaterial.  In other words, if the effect is minimal or does not represent a significant change in the financial position of the account then it might be considered immaterial.

Balance sheet

Contains accounts whose value is determined at a specific point in time.

Assets – accounts with value that you own

• Cash – the amount on hand or in the bank at a specific point in time
• Accounts Receivable – how much people owe you
• Inventory – the value of business merchandise for sale
• Fixed Assets – the value of property and equipment

Liabilities – accounts with value that you owe to others

• Accounts Payable – how much you owe others for unpaid purchases
• Debt – how much you owe others for money borrowed
• Other Liabilities – services or money owed to others

Equity – accounts with paid in capital or earned from profits.

• Contributed Capital – money invested in business by ownership
• Distributions – dividends and other types of money paid out to ownership
• Capital Stock -            money invested in exchange for company ownership
• Retained Earnings – earnings retained in business from net profits

Income Statement

This statement contains accounts whose value is determined over a period of time (e.g., day, week).

Income: total sales and income recorded over a period time

Expenses: total purchases and other expenses recorded over a period of time

Basic Accounting Formula

All transactions are posted to one or more of these accounts.  As discussed earlier, every posted transaction must balance.  That is, debits must equal credits.  Furthermore, the result of every posting, if done correctly, will never put the Basic Accounting Formula out of balance.  Asset accounts will always equal the total of all liability and owner equity accounts.  If this formula is ever out of balance, the cause will always be an incorrect transaction posting where debits did not equal credits.

Assets include those accounts, which give value to the company: cash, accounts receivable, inventory, property, etc.  Liabilities are those accounts which reduce the company’s value:  accounts payable, debt, and other liabilities.  If total assets are greater than liabilities, then this net value (that is, the total of all assets minus liabilities) represents the true value of the business, otherwise known as its Equity. Hence, the Basic Accounting Formula can be expressed and equally understood in these two ways:

Assets = Liabilities + Equity

or

Equity = Assets – Liabilities

If the company’s assets are less than its liabilities, then it will necessarily show a negative equity.  This makes intuitive sense to anyone following the demise of a business in bankruptcy.  When a business owes more than it has in value, the resulting negative equity is an obvious warning sign.

The equity accounts include owner’s contributions, distributions, and retained earnings.  Retained earnings operate in a manner unique to all other accounts.  It contains the net effect of postings to all income and expense accounts.  It is truly the one account, which links the balance sheet accounts (assets, liabilities and owner’s equity) with the income and expense accounts.

Understanding the importance of retained earnings, the Basic Accounting Equation could be expanded thus:

ASSETS  =  LIABILITIES  + (Investor and owner contributions, and distributions + Retained Earnings)

OR

ASSETS  =  LIABILITIES  +  (OWNER’S EQUITY ACCOUNTS +  INCOME – EXPENSE)

———————EQUITY ———————————

When a transaction, like writing a check or paying a bill, is executed in an accounting program, the software is designed to take this transaction event and create the proper and necessary debit and credit entries to record the effects of the transaction in the appropriate journals and general ledger accounts.  Your accounting policies and procedures should help you acheive accounting control.

Last week, we identified three elements that drive up your cost of compliance: cost of improvement, cost of review, and cost of scale.  Your cost of improvement can be managed by the improvement projects you choose.  Your cost of review is a relatively fixed, ongoing yearly expense, based on your cost of scale.  Your cost of scale defines how expensive your entire compliance program will be, now and in the future.  Ergo, the more procedures you write, the more expensive compliance becomes.

How Do You Keep Your Compliance Costs Under Control?

Writing procedures for internal control can produce diminishing returns.  Every procedure written carries with it a lot of overhead.  Overhead in this case consists of more than the original documentation effort — the design and development.  It includes implementation and review — document control, training, usage, auditing, management review, and regular updates.

Writing more procedures costs more money; it also reduces risk, but only up to a point.  The point of diminishing returns is where the time and effort you spend on a task stops yielding rewards.  You reach a break-even point, and when you reach that point varies according to your situation.  The common perception is that as you write more procedures, you reduce risks (compliance risk, for instance) further. This would be true if you followed all implementation steps; the reality is that most companies do not follow all implementation steps.

Any implementation step you leave out increases your risk; you lose all the intended benefits of your procedures.  You might think you’re saving money by foregoing certain steps in the implementation process.  Think again.  The opportunity for quality defects, customer complaints, and material weaknesses rises when you take shortcuts.  The likely result is a corrective action loop due to user complaints that your policies and procedures don’t work.

Starting with a clear, compact scope is key to controlling your compliance costs.  The size or scale of your operation — the number of operating locations, number of employees, and the number, complexity, and interconnections of processes — means more risk management, internal controls, and processes to be understood, documented, and controlled.   Learn to pick your battles — focus on the most important processes first!

Map out your core processes with a “big systems perspective” process map.  ISO 9001 certification requires six procedures — document control, record control, internal auditing, control of nonconformities, corrective action, and preventive action — so if ISO 9001 certification is what you’re after, start with those processes.    Sarbanes-Oxley compliance is risk-based, so identify the greatest risks to your company, prioritize them, and write procedures that address those risks first.  This will give you the greatest return on your procedure investment.

Quality defects are to ISO 9001 as financial risks are to regulations like the 8th EU Directive and Sarbanes-Oxley.  You can reduce the scope of your compliance program by addressing the areas with the most defects or the greatest risks first.  As legislative bodies and enforcement agencies have often said, you shouldn’t try to address everything all at once.  Start by reviewing the materiality of the defects or risks to your company.  Decide on a threshold, or cutoff, for materiality.  Don’t worry if you miss the mark on your early attempts: Improvement is an ongoing process, not an event.

Be agile and think about the speed of your procedures implementation.  Most process procedures projects stall because they’re overtaken by current events.  Immediate business needs take precedence, of course, but you risk losing focus and that sense of purpose with your procedures project when you shelve it, so you’re less likely to achieve compliance or those other benefits you were looking for when you took on the project in the first place.

Only write procedures you know you can implement fully.  A written procedure nobody uses is worse than none at all, because of the wasted effort.

Starting with a manageable scope will help you realize your goals and keep your compliance costs down. Work through your procedures incrementally; next year, lower your risk threshold and address more risks, then a few more the year after, and so on, until you’re comfortable.

Management decides on the internal controls needed to cover the identified defects and risks.  If they decide wrong and pick a threshold that’s too high, you’ve identified a material weakness in your quality or risk control framework.  That can be a very good thing, as long as you work on improving your internal controls.  Do so, and you have a working management system that ensures compliance.  Isn’t that what you wanted in the first place?

Using prewritten procedures saves time researching, writing, and implementing accounting policies, procedures, and internal control.  Download free samples now and get started on your procedure development project today!

Static versus Dynamic Systems

When I was studying engineering in college we had to take many different classes in control.  The simplest ones to talk about are the mechanical versions of static systems and dynamic systems.  Static systems are those that don’t change over time like a bridge or a flag pole.  You had to figure the forces on these systems and calculate the stress, tension, torque, etc.  I found statics pretty straightforward.

Next came dynamic systems, which are static systems that can (as a result of other forces) change over time like a suspension bridge that sways in the wind.  Things got tricky, fast.  We had to use fancy calculus like differential equations to solve the problem.  Why (you might ask)?

The thing about static systems is that you have no feedback.  So the static equation is drawn with the forces in balance and feedback set to zero.  With no feedback the problem is easy or relatively easy using basic calculus.  In contrast, dynamic systems have feedback.  The wind pushes on the bridge and the bridge pushes back (basic physics: a force is met with an equal but opposite force).  This “pushing back” starts the feedback, but feedback can also produce feedback loops, which means the bridge begins to oscillate as it rocks back and forth in the wind.

You see the wind is not a constant force, its velocity changes over time.  So this is a complex situation that becomes difficult to solve.  If we fail to produce the right answer, the bridge could fall apart in the wind (it has happened).  Positive feedback loops amplify the signal and can cause such destruction (i.e. a vicious cycle) whereas negative feedback loops reduce the signal and result in… control.

So when you design your procedures, are you designing in positive feedback loops that amplify your output and lead to the destruction of your process or are you designing in negative feedback loops that result in the control you are looking for?

Static versus Dynamic Control

Funny, we have to take into account the dynamic nature of a bridge before we built it but do you take into account the dynamics of a business process when you capture it in your knowledge management system?

Business policies and procedures are not static.  They involve people that provide feedback; they involve customers, suppliers, and management that all provide feedback. So how do you integrate this natural feedback into your procedure?  Start by planning for it.  Plan for both positive and negative feedback but most importantly harvest the negative feedback.

Planning for feedback means data, scoreboards, process reviews, process audits, management reviews, customer and supplier surveys, discussions, interviews, comments, and most of all collaboration.  We need to design collaboration into business procedures to allow for the natural feedback process to occur.  Just like building a bridge requires us to understand the forces at work BEFORE we build the bridge, so it is with building business policies and procedures.

Compliance and Control

Can you really have compliance without control?  You can check the box that a business procedures exists but a procedure requirement is not about existence it is about deployment and usage.  There is a reason for every requirement.  The standards we talk about (ISO 9000, Sarbanes Oxley, GMPs) are all about reducing risks or reducing risks using negative feedback right?  The next time you have to write business procedures think about how you can introduce negative feedback to obtain the control that the standards are really asking for.

Cash Management is Vital for Internal Control

Sloppy approaches to cash management can lead to temptation. Employees handling a significant amount of cash carry the greatest opportunity for fraud or abuse. Cash handling procedures are used to minimize cash handling risks. Multiple cash counts by different people make the basis of sound cash controls.

For example, the same person who handles the money should not be the one accounting for it. Cash funds should be counted often and by at least two people. Different people should handle cash, checks and deposits from those who record them in the books.

Cash handling procedures are one area auditors examine. Poor cash management policies and lack of control over cash handling will certainly make a poor impression, and possibly even impact an auditor’s perception of your accounting practices. Good controls using cash policies and procedures that are clearly communicated and regularly audited internally indicate to external auditors that cash controls are working.

Cash Policy and Cash Procedures Set Organizational Tone

Not only do proper cash policies and useful cash procedures send a clear signal to auditors, it also creates the required operating environment for employees. Due diligence and transparency involving regular management activity (including creating and updating cash policy and procedures) sets a tone that professionalism is the standard. Mistakes that are quickly caught and corrected convey a clear message about the importance of proper cash management.

Understanding key elements of your business, setting the proper environment for employees, creating a positive impression for auditors; these are just some examples of how proper cash policies and procedures can help your business. If you don’t feel you have the proper cash management controls in place, it is never too late to start. Begin by understanding your cash processes and identify what is important and what risks you face. Address them by creating cash procedures that incorporates data collection and review as well as the typical controls such as second person reconciliation.

If your business relies on cash flow, as most do, why would you leave cash management to chance?

Accounting Policies Communicate Strategy

Accounting policies are an important way to communicate management’s philosophy or vision for running the organization.  It is within this framework that employees use accounting policies to guide decision making as well as establish effectiveness criteria, key performance indicators, or metrics that help determine the organization’s level of success.  Implementing accounting policies and procedures is one method of creating the internal controls needed for a successful and compliant (i.e. SOX) organization.

Accounting policies that don’t communicate management’s vision for operations, but simply state hard and fast accounting rules without explanation are less useful in communicating with employees.  Let’s take a look at a credit policy that expresses overarching goals:

The organization should provide credit in a timely manner to maximize sales and minimize risks in collections.

In other words: The organization provides fast credit to customers who will pay.  This is an example of management’s philosophy.  In order to fulfill the goal with objectives, we will need to establish effectiveness criteria based on stated goals: timely manner, maximize sales, and minimize risks.  This, however, is what a well-defined process does.  It establishes specific effectiveness criteria that can be modified to the changing conditions that all businesses and departments face.  The specific, measurable objectives have flexibility because the overarching goals of the policy remain constant.

A rule based accounting policy could be written as:

The organization provides $5,000 in credit to first time customers.

Does this leave the credit staff any latitude to make decisions to fulfill the mission?  Do you want your credit staff to follow accounting rules even when they are wasteful or detrimental to sales?  In this instance they could turn away a potentially great customer with an excellent credit rating because of this rule.

This is an example of a ballistic process focused on static credit criteria.  There is no way to judge how effective the policy and process are because people just follow the rule with no method of measurement or evaluation.

There are always exceptions to the rules, but when rule-based policies are given (instead of an overarching strategy or philosophy behind the rules), then employees are not empowered to make those decisions.  Accounting management should always be looking for ways to empower staff members to make good decisions, and a big impediment to making good decisions is the lack of information. Creating an accounting manual of clearly written accounting policies and procedures that express management philosophy is one way to communicate important information to the staff.

Accounting Policies Lead to Performance Criteria

Viewing accounting policy as way to communicate information about the overall mission or strategy of a particular function or accounting process does aid and inform organizational members.  When these overarching goals of the accounting process are translated into specific metrics or effectiveness criteria, now the puzzle is complete.  Your accounting policies should provide the guidance that helps establish criteria, but the accounting policy itself should not be the criteria.

In terms of an accounting manual for internal control, which method provides better internal controls: a set of accounting rules that may or may not be followed; or expressed guidance that fulfills organizational goals and leads to establishing criteria, which in turn clearly demonstrates how effective accounting processes are carrying out accounting policies?

Rules may be followed, and one could claim that they provide control.  But expressed rules will never play a role in improving the organization, and improvement should always be an organizational goal of any accounting manager or organizational leader.  Thinking of accounting policies as an expression of mission or strategy is a positive step in establishing clear communication with your staff and starting down the path of continual improvement.

To learn more about Bizmanualz Accounting Procedures go to http://www.bizmanualz.com/accounting/ and check out the Accounting Policies and Procedures Manual or sign up for the Bizmanualz Newsletter and download a free sample accounting procedure right now.

The Stages of Effective Risk Management

Risk management can seem like an overwhelming and daunting task – but only if you try to envision, predict, and prevent every imaginable risk all in one swipe.  The trick to successful risk management is to break it down into manageable stages and tasks.  Using a continual improvement method, identify and mitigate high priority risks first, and then continually improve your risk management by regularly reviewing and prioritizing risks and addressing them according to your organizational needs.

The basic steps of risk management include:

1. Understand the Mission
2. Perform risk assessment to identify and categorize risks
3. Prioritize risks and activities
4. Design processes, training, and checks/metrics (controls) for top level risks
5. Monitor internal control effectiveness and improve as required
6. Repeat steps 2-5

Methodical Risk Assessment Leads to Proper Internal Controls

The first step in conducting effective risk management is understanding the mission.  Clearly identifying and articulating the mission makes recognizing the risks to mission success much easier and much more effective.  In terms of Sarbanes-Oxley and SOX Section 404 – understanding the mission is easy.  The SOX mission is to create accurate financial statements and avoid a material misstatement.

Once you identify the mission, begin risk assessment by listing the possible risks to accurate financial statements (i.e. improperly listing assets).  There are several approaches to listing possible risks, but the most effective ones employ a methodical technique.  For example, for financial statements a methodical risk assessment approach could be to identify inputs to your financial statements, and then work backwards to consider input sources, processes, etc;, listing possible reasons for incorrect information.  It also might be useful to consider typical categories of risk such as system/process problems or weaknesses, human error, and fraud.

Prioritize Risks to Determine Internal Control Activities

When trying to assess possible risks the goal is to be exhaustive.  You may end up with a sizable list, but that is an expected risk assessment outcome – don’t let it intimidate you.  Think of it as useful information.  It is unlikely that you will be able to address all the listed risks from your risk assessment at once.  The goal should be to identify high priority risks and focus on those first.   Now you are creating an internal control system that complies with Section 404 Sarbanes Oxley.

Fig. 1: List risks, and then plot them according to impact and likelihood

Creating a matrix or graph of risks by likelihood versus impact is a great tool in finishing the risk assessment task and moving toward risk management.  For example, you could have the risk/internal control committee rank every risk item on the list for probability and impact.  Then average them and plot them as R1, R2, R3, etc;, as they are plotted on Figure 1.   Obviously, after plotting risks, those with highest probability of occurrence and the highest potential impact (or in terms of financial statements – materiality) should be addressed first.

How many risks are addressed at one time depends on the size and capability of the organization.  A large organization with lots of resources might focus risk management on the top 12 or 15.  A small organization might only be able to set a goal of attending to the top three or top six risks in the first pass.

Managing Risk with Internal Controls

Now that you have identified the most important risks to manage, the next step is to identify the best way to mitigate them. A typical method is to create well-defined processes that help minimize the risk.  The process should account for the inputs, outputs, as well as process activities, but the process should also incorporate metrics and check-steps.  This builds in the capacity to monitor the process’ effectiveness right into the process itself.  Once your process is defined, then it is communicated through policies and procedures, training, and work instructions.  We will go into more detail about the role of policies and procedures for a SOX Section 404 internal control system in next week’s article.

Continually Improving Risk Management and Internal Controls

Once in place, processes should be monitored by regularly verifying that process checks are functional and that process metrics demonstrate effectiveness.  Corrections are made as required. Once these processes are fully operational and demonstrated effective, it is time for Step 6: repeat the risk assessment / risk management process in order to address the next level of risks. Be sure to begin with listing and plotting risks at the start of every iteration. (It will be easier each time through.)  Internal situations and operational environments change over time, so risks and their priorities change as well.

If you are having trouble envisioning your internal control system, risk management techniques can get the ball rolling.  These risk management activities also improves other components of an internal control system as listed by COSO:  the Control Environment, Control Activities, Information and Communication, and Monitoring.  Congratulations, you are slowly and surely building an effective internal control system by prioritizing and addressing your risks.

To a degree, the confusion over SOX seems inordinate in relation to the complexity of the regulation. Actually, compared to the intricacy of other regulations enforced by the Securities and Exchange Commission (SEC), Sarbanes-Oxley compliance is relatively straightforward. It is somewhat hard to understand why there is so much misunderstanding about Sarbanes-Oxley, so let’s review the basics.

SOX Compliance Basics

As noted, for the most part the efforts required to comply with SOX should not be difficult. In fact, the most arcane sections of the law require no effort by publicly traded companies whatsoever. These Sarbanes-Oxley sections deal with topics such as:

• Authorization and establishment of the Public Company Accounting Oversight Board (PCAOB)
• Funding and reviewing studies on corporate accountability and fraud
• Increasing punishment for white collar crime

As a brief overview shows, most sections of the SOX regulation that do require action by publicly traded companies are not that demanding:

• Creating an Audit Committee from the Board of Directors to oversee independent financial auditing activities, directly receive audit reports, and develop a process for receiving and investigating anonymous complaints about unethical accounting practices. The committee must be chaired by someone with accounting or finance experience.

• Using auditors that are independent from other company relationships, are registered with the PCAOB and comply with its requirements, and lead auditors that are rotated at least every five years.

• Avoiding improper relationships and creating transparency through implementing policies such as restricting employee movement between auditors and the organization; disclosing financial transactions (i.e. loans) with executives and officers; disclosing major stockholders; restricting officer and executive trading of company stocks when other employees are restricted from doing so; and prohibiting retaliation on whistleblowers.

• Management establishing an internal control system that ensures proper accounting practices and safeguards, produces accurate financial statements, as well as annually verifying the control system’s effectiveness.

Sarbanes-Oxley Section 404 Internal Control Compliance

It is that last item listed, management establishing and verifying an effective internal control system listed in SOX Section 404, that causes the most problems for publicly traded companies. Between Sarbanes-Oxley passage and its implementation, the SEC was inundated with questions and inquiries about how to comply with this internal control requirement.

In response to these concerns the SEC pointed to a 1992 report from The Committee of Sponsoring Organizations of the Treadway Commission (known as COSO) called “Internal Control – Integrated Framework.” The SEC cited this COSO report as one example of internal control, but also indicated that this was by no means the only method of effective internal controls.

The Role of Procedures in SOX Section 404 Compliance

It is somewhat unclear how well the SEC’s reference to the COSO report helped in clearing up confusion over internal controls. In response to the requirement, some companies began to “procedure-ize” all of their activities in finance and accounting, mistaking mounds and mounds of procedures for an internal control system.

While procedures are an important component of internal control, creating stacks of paper really only exacerbates the problem. By writing everything down in great detail and putting it in procedures you are setting your internal control system up for failure. Now anytime you do something somewhat differently than what is minutely documented in your procedures – you are not in compliance because you are not following your control system procedures.

In the next article in this series we will further consider the more (or only?) complicated aspect of Sarbanes-Oxley compliance: creating an internal control system and the role of accounting procedures, and the important role of using internal controls to address risk. In the meantime, feel free to browse sample procedures from our CFO-Controller Series and review the selection of accounting procedures for an accounting or finance control system. Our pre-written, editable accounting procedures in MS Word format are based on established best practices, and can provide an important head-start for developing key procedures as part of internal control.

To learn more about Bizmanualz Accounting Procedures go to http://www.bizmanualz.com/accounting/ and check out the Accounting Policies and Procedures Manual or sign up for the Bizmanualz Newsletter and download a free sample accounting procedure right now.

SOX, in general, has generated a lot of discussion about internal controls: what are they and what do they do? Historically, for business finance and accounting processes, controls have typically referred to preventing fraud and abuse. Increasing regulatory requirements have caused compliance to tax & public company financial reporting regulations to become part of control system goals.

In this view, a financial control system identifies who approves expenditures, signs checks, and reviews ledgers to accounts, as well as listing the required records and who keeps them. Is this really all an internal control system does?

What Is the Purpose of an Internal Control System?

Financial reporting and compliance are two areas which COSO explicitly claims to address with its integrated framework. However, COSO also lists a third area where internal controls play a vital business role – effectiveness (reaching objectives) and efficiency (required resources) of operations.

As we have stated in past articles, if you develop and implement an internal control system and the only objectives are to prevent fraud and comply with laws and regulations, then you are missing an important opportunity. The same internal controls can also be used to systematically improve your business, particularly in regard to effectiveness and efficiency.

COSO Describes a Control System Framework

COSO lists five components that must be in place to some degree for an internal control system to be effective:

• Control Environment (The tone and culture of an organization)
• Risk Management (Event identification, risk assessment, risk response in recognizing threats)
• Control Activities (Policies and Procedures in place to direct key organizational activities)
• Information/Communication (Capturing and disseminating information throughout the organization)
• Monitoring (Evaluating operations through measurement, auditing, etc;)

Using a Control System to Drive Improvement

Let’s look at how effectiveness and efficiency of operations is played out using one example of the five components in the internal control framework – Control Environment.

The Control Environment of an organization is described as the foundation for the other components of internal control. It is the tone and culture of the organization upon which all other activities are conducted, and in most organizations it flows from the top. More specifically, how involved is management in setting realistic goals and then ensuring the organization has the resources to carry them out?

We can look at two contrasting styles. In the first, organizational goals fall from the sky with no involvement from those tasked with carrying out activities to reach objectives. Then results are either ignored altogether, or they are ignored until the end of the period; upon which you receive a nod of the head or a wag of the finger – depending on performance.

On the other end of the spectrum, management sets goals and objectives using a corroborative process. Management regularly reviews progress and performance along with leading indicators to determine if objectives will be met, and if not, identify if any d corrective action should be taken.

Sometimes there may be valid reasons for missing objectives: how well they are considered and absorbed into the organizational knowledge is also a function of the Control Environment. Participative management is one of the most important ways to set a proper environment or tone where using resources to reach objectives actually means something, not empty phrasing.

We could find examples of how control systems improve performance in all components. Through Control Activities, for example, policies and procedures can also incorporate the idea of setting process objectives along with regular measurement and review, as well as creating communication channels between key departments. In fact, all the procedures found in our policies and procedures manuals follow the Plan-Do-Check-Act philosophy of continually improving processes, including our soon to be released Finance Policies and Procedures Manual.

Communication activities can be built into the processes and procedures, creating communication channels that seem to frequently be lacking in organizations. These communication channels help create and communicate strategic level goals and objectives, which inform departments and segment level goals and objectives (which are also created as part of the control system). This kind of strategic alignment of objectives creates synergistic power in an organization.

COSO certainly fits our philosophy of control systems – where control isn’t only about preventing fraud and complying with regulations. Control is about having the philosophy and tools in place to be effective and efficient: and that is about doing things a little better tomorrow, next week, next month, and next year.

To learn more about changing your paradigm and using process improvement programs for your organization then attend the next How to Align a System of People and Processes for Results class. If you are eager to learn more about creating more order out of the chaos you are feeling at work then the How to Create Well-Defined Processes class is right for you.

ISO 9000 Internal Auditor classes are forming now. Call for information on having your own private in-house classes today.

What Is the Point of an Internal Control System?

It is interesting to note, however, that in many cases the internal control system at public companies consists of a volume of instruction-like procedures that document activities. If a company is taking the time and effort to develop a procedure based, financial control system, then it seems worth the small amount of additional of effort it would take to:

• understand major financial processes
• establish key finance polices and goals (including performance goals as well as producing accurate financial statements)
• determine which processes provide a level of risk or materiality in reaching financial goals
• prioritize development of the control system according to materiality, risk, and other important goals
• incorporate best practices and a continual improvement philosophy to build effective processes and nurture a culture of improvement

Is there a better indicator of an effective control system than clear goals and key performance metrics that are consistently measured and regularly improving?

So the question that applies to companies of all sizes, shapes, and types: Are you taking advantage of the financial control system to improve process results and drive your financial performance upward?

Improving Processes in the Production and Office Space

Discussions of improving processes are too commonly relegated to the production floor. Is it any less important for your office processes to function effectively and efficiently? How well does you company manage financial aspects like working capital, debt and investments, and leasing? These are just as vital to success as how efficiently production operates. Yet, few companies attempt to understand and improve finance processes to the same degree.

In fact, a lack of focus on finance is common, especially among privately owned SMBs. Research shows that a majority of SMBs do not create capital plans, do not actively manage working capital, nor do they conduct analysis of financial statements.

It can even seem a bit humorous to consider the controls and checks businesses put in place, for example, to prevent minor pilferage from the cash drawer, while having no processes in place to, say, conduct basic ratio analysis of financial statements in order to understand the meaning behind the numbers.

Do you know if you are making money on the cash you borrow? Or how about the assets you deploy like accounts receivable, inventory, or cash. What about the asset acquisitions you make? These are hard questions to ask for some but when it comes to business finance, these are the questions you should be asking – before you raise debt or equity capital.

What really represents the biggest threat to the success of your business; Mary Lou borrowing a fin from the till when she is caught short at lunchtime on Friday, or having no thought-out and consistent methods for managing high level financial processes that can represent millions in losses when they go bad? The answer should be obvious.

A Financial Control System that Focuses on Improvement and Success

Of course, we are not saying that businesses should ignore prudent controls over their cash drawer. The point is that focusing on small components while not knowing how much cash is tied up in receivables does not represent a control system that recognizes priorities and risk. Focusing solely on the rote and mundane does little to improve your overall financial performance. Financial control systems shouldn’t just be about compliance, they should be about continually improving key aspects of the financial operation such as:

• Regularly reviewing and improving the overall capital structure.
• Using a capital plan to minimize the cost of capital while strengthening the Debt/Equity position.
• Managing working capital so excessive inventories and receivables do not sap financial resources.
• Ensuring proper calculations and scenarios are explored while making debt/investment or leasing decisions.
• Maximizing returns while minimizing costs for cash and merchant accounts.

A control system of well-defined processes is not only about control or compliance, it is also about consistently striving to do a little better. Control systems that are designed only to achieve compliance are doing the bare minimum, and they represent a missed opportunity to gain improvement and a competitive edge. And that should be enough reason for any size and type of company to think about using a continual improving process approach to creating a financial internal control system. Sox is nice; but continual improvement is better for everyone.

Bizmanualz Procedure Templates Incorporate the Continually Improving Process Philosophy

Last spring we introduced the Bizmanualz Sales & Marketing Policies, Procedures & Forms manual. Our Sales & Marketing manual applied the well-defined, continually improving process approach to a vital business segment. In early March we will be releasing our next manual product – the Bizmanualz Finance Policies, Procedures & Forms. Our goal with the Finance manual is to help businesses of all kinds to take control of their financial processes by consistently implementing best practices, then measuring and reflecting on the results to identify and implement improvements.

There is no reason to start from scratch. All of Bizmanualz policies, procedures & forms products are thoroughly researched to implement best practices while employing a continual improving process approach, and they are reviewed by subject matter experts who work in the field. Plus, every manual includes a CD with all the procedures and forms in Microsoft Word format, so you can easily customize them to meet your needs.

In the coming weeks, we will continue to explore how a process approach can improve your financial performance in areas such as creating capital plans and managing working capital.