Internal Control Reviews – What Is It and Why do I Need One?

The Association of Certified Fraud Examiners (ACFE) in their recent “The Next Normal: Preparing for a Post-Pandemic Fraud Landscape”, found that 71% of organizations, across industries, are expecting an increase in fraud over the next year, and 51% have already experienced increased fraud. The list of things that has caused this is endless (decreased staff, lax work-from-home policies, new federal funding, changes in supply chain, etc.), but the most important thing is understanding what YOU can do to reduce fraud in YOUR organization.

One of the first things we suggest when it comes to preventing fraud and staying out of the news cycle is an internal control review (ICR). The first response we get to that, though is, “well, we have an audit each year, so that should cover us”. What people often forget, though, is that an audit is NOT there to find fraud. Auditors are required to gain an understanding of your internal controls and may have some general suggestions, provided in a management letter, but governments should be looking for more than general suggestions in our greatly changed business world. That’s when it’s time for an ICR.

Start With A Conversation

An ICR starts with conversations. We talk to employees and managers, getting an understanding of what staff do on a daily, monthly, and annual basis. This doesn’t include just the accountant or director of finance. It encompasses everyone in the organization that is involved with funds; from the administrative assistant making an initial receipt listing, to the park director taking camper fees, to the director of finance approving million-dollar transactions. This step is perhaps the most crucial. It’s a fact-finding mission, designed to understand the current process but to help everyone in the government understand the purpose of the ICR, and recognize its value. The greatest internal controls in the business won’t prevent fraud if the people involved don’t recognize their value and follow them!

Documentation

Once we’ve documented all the financial processes of the organization, we come to the report. What is unique about an ICR vs. a management letter is that the approach to this step isn’t just a generalized comment about best practices. The ICR recognizes that there are limitations in staffing, staff location, hours in the day, etc. When we write this report, then, we take our expertise about what the best practice is, but blend that with the unique circumstances of the government. What you get, then, is a customized recommendation, tailored to YOUR needs and operations. Take for example, timecard approval. Government X has a policy that all timecards must be approved before payroll is initiated, but three of our department heads are out in the field each day, and don’t review timecards timely. What you’ll get from a management letter is a comment that the policy needs to be followed. What you’ll get from an internal control review, though, is that prior approval is certainly a best practice, so if there are directors working in the field, it’s a great time to explore a payroll provider that allows review and approval via an app. We can maintain controls and protect the organization, without slowing down operations.

What’s Next

Where many ICRs fall short is in prioritization. It isn’t enough to just have a report that has 20 different suggestions. Entire processes can’t and shouldn’t be changed overnight. Any successful implementation must be prioritized and phased in. What is unique about Maner’s ICRs is that we provide customized risk matrices, designed to help management identify where to start the process. Items that have the greatest risk and the great possibility of happening are prioritized, allowing for immediate, tangible results.

We know that one of the best ways to reduce fraud is to create a “perception of detection” and having an ICR is a great step in that direction. Combine this mindset with the strong, yet efficient, internal controls that result from this process, and you’ve got a government where the focus can be on innovation and service.

Maner’s governmental and fraud experts are here to help with this process and get you where you want to be!