Effective Internal Control Strategies

Transcription

1 Effective Internal Control Strategies 1. The unique nonprofit environment A. Reliance on contributed services of volunteers B. Many volunteers have a limited nonprofit financial background C. Revenue often comes in the form of contributions for churches, cash contributions D. Christ-centered nonprofits often place a higher degree of trust in employees and volunteers without implementing effective controls 2. Who can help you understand the easiest ways to game your accounting system? A. The auditors? B. System consultants? C. The staff and volunteers using system? 3. Are your asset protection risks the greatest: A. Before the assets are recorded on your books: skimming B. Cash larceny: after cash has been recorded on your books C. Billing schemes: a perpetrator causes the organization to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases D. Payroll schemes: an employee causes the organization to issue a payment by making false claims for compensation E. Expense reimbursement schemes: an employee makes a claim for reimbursement of fictitious or inflated business expenses F. Check tampering: a perpetrator forges or alters a check on one of the organization s bank accounts, or steals a check the organization has legitimately issued to another payee G. Cash register disbursement schemes: an employee makes false entries on a cash register to conceal the theft of cash 1

2 H. Noncash misappropriations: an employee steals or misuses noncash assets of the organization I. Cash-on-hand misappropriations: the perpetrator misappropriates cash kept on hand at the organization s premises 4. Balancing asset protection with efficient operation is the goal of internal controls. A. If controls are too tight, employees and volunteers will find ways to bypass them. B. Selecting the appropriate mix of controls often depends on factors such as the type of accounting system, the nature and volume of accounting transactions, and staffing levels. 1 C. Internal controls are for the protection of the organization and the individuals performing accounting/finance tasks. 5. General internal control principles A. One size of internal controls does not fit all organizations controls must be scalable B. Segregation of duties. 1. For revenues and cash receipts, the same person does not handle all the following aspects of a transaction: Receiving the cash Processing the deposit Recording the transaction Reconciling the bank statement 2. For expenses and cash disbursements, the same person does not handle all the following aspects of a transaction: Authorization Processing Check signing Reconciling Bank reconciliation 1 PPC s Guide to Religious Organizations, Ft. Worth, Ninth Edition (2010),

3 C. Dual control of cash and checks at least until counted D. Control environment 1. Establishing the atmosphere of integrity 2. Getting the right people in the right places 3. Encouraging the high road 4. Developing your staff E. Risk assessment 1. Determining your external and internal risks 2. Reviewing your risks in light of your objectives 3. Determining ways to mitigate these risks 4. Reviewing risks as the operating environment changes F. Control activities 1. Policies and Procedures Commonly just called Internal Controls 2. Implemented across the entire organization at all levels comprehensive 3. Examples approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets, or segregation of duties G. Information and communication 1. Getting the right information to the right people at the right time 2. Make your systems work for you not the other way around 3. Emphasizing the importance of controls from the highest point on down H. Monitoring 1. Monitor for changes in the environment 2. Look for undiscovered mistakes an undiscovered mistake leads to the development of opportunity under the fraud triangle 3. Monitor for trends 3

4 4. An ongoing process not an event 5. Report issues or possible gaps in controls I. Employee theft insurance is not a substitute for sound internal control. J. Fiscal policy and procedures manual 1. Provides clarity of responsibilities and roles 2. Serves as a reference point during staff transition 3. Provides clear job descriptions 4. Reduces staff anxiety around reimbursements, e.g., petty cash or travel and expense 5. Staff takes ownership of the process and its results 6. For larger organizations, it provides smoother inter-departmental communication 7. Ensures adherence to proper internal controls 8. Meets expectations of external monitoring agents: a. The accounting profession b. Governmental entities and funding sources K. A word about COSO 1. COSO is short for the Committee of Sponsoring Organizations of the Treadway Commission 2. Usually applicable for larger organizations 6. Specific factors which may contribute to good internal controls A. Background checks (criminal and credit) B. Use of a lockbox C. Use of a positive pay system D. Special controls over wire transfers E. Controls over receipts by credit card F. Special controls over lines of credit 4

5 G. Special handling of voided checks H. Reviews for ghosts on the payroll and ghost vendors I. Bank reconciliation by individual independent from other accounting functions 7. Internal controls and fraud prevention A. A key to sound financial management is being aware of the possibility of fraud and taking reasonable steps to prevent it. B. Fraud is like fire in that it takes three building blocks in order to happen 1) Pressure frequently financial or social pressure 2) Opportunity thinking there is an ability to get away with it no one commits a crime thinking that they will get caught 3) Rationalization ability to reconcile what they re doing to some sense of reasonableness the person has to be able to sleep at night, in fact most don t believe they re doing something wrong because they ve rationalized it in their head. Frequent examples include I was just borrowing it or I ve earned this extra bonus for my hard efforts. C. There is likely someone at your organization that has two or three of these issues. D. Fraud can be perpetrated by insiders or outsiders. 1) Outsiders a. Ponzi schemes b. Check manipulation c. Credit card/identity theft d. Computer/website systems manipulation 2) Insiders a. Check forgery/redirection b. Invoice manipulation c. Personal use of ministry credit cards d. Noncash/asset misappropriation e. Computer systems f. Cash handling 5

6 E. Fraud occurs when there is a breakdown or non-existence of internal controls. 8. How is fraud discovered? A. During the course of a CPA s financial audit: 2% B. As a result of an internal audit: 18% C. By whistleblowers: 30% D. By accident: 50% 2 9. So what can we do? A. Create an environment of integrity and accountability a. Encourage, don t discourage staff wanting to take reasonable steps to take a high road b. Make it easy for staff to express concerns, suspicions or inconsistencies without fearing they may be jeopardizing their employment. c. Have a sound whistleblower policy. d. Educate employees about the reality of fraud this will help them to understand why it is important to notice inconsistencies e. Communicate and demonstrate that oversight is being carried out. This helps reduce the likelihood of opportunity from being established within and would-be fraudsters thinking. 10. Additional handouts A. Include list of traits typical of those perpetuating fraud B. Include list of questions to review for internal control testing C. Include sample internal audit form D. Basic Internal Controls 2 Preventing Fraud in Nonprofit Organizations, Edward J. McMillan, John Wiley & Sons, 2006, 7 6

7 Traits Typical of Those Perpetuating Fraud 1. Wheeler-dealer attitude answering to a higher law alone 2. Unusually close association with vendor/customer 3. Excessive pressure from within organization 4. Living beyond means 5. Control issues, unwillingness to share duties 6. Refusal to take vacations 7. Addiction problems 8. Past legal problem 9. Irritability, suspiciousness, or defensiveness 10. Past employment-related problems 11. Complaining about inadequate pay 12. Complaining about lack of authority 13. Divorce/family problems 14. Financial difficulties 15. Excessive family/peer pressure for success 16. Instability in life circumstances 7

8 Nonprofit Organization: Fiscal Policies and Procedures Staging Questionnaire Organization Name: Contact Name: Address: Telephone: Fax: _ Organizational Components Request a list of current directors/members/trustees Request a list of current officers Request organizational chart for organization as a whole; for fiscal office Number of employees: Related organizations: Request management letters (as many years as relevant) Request audit report for prior three years A. Cash receipts 1. What is your organization s Annual Budget? Please include how it is broken down between government, private, corporate and individual grants/donations: Type of Funding Percentage Government % $ Foundation % $ Corporation % $ Individuals % $ Other (please describe) % $ Total 100% $ Dollar Amount 8

9 2. Receipt and recording of gifts and grants: Who is responsible for opening mail? Receptionist/Development Office When grants or gifts are received, who is responsible for depositing the grants/gifts into organization bank accounts? Is there adequate segregation of duties? (Does the person opening the mail or collecting gifts and grants also have access to deposit slips, bank account information, and accounting ledgers?) Is the person who prepares deposit slips different from the person who prepares bank reconciliations and maintains the receipts log? How are cash receipts recorded? How are donor/grantor designations reflected in the accounting records? Restricted vs. Unrestricted How often are deposits made? Is there a reconciliation of bank statements to deposit tickets and receipts log? 9

10 3. In-kind gifts and fixed assets: How are in-kind gifts valued? What controls are in place to ensure that in-kind gifts and fixed assets are used for the purpose intended? (Controls to prevent unauthorized use) Are fixed assets and in-kind gifts periodically inventoried? Does the organization have procedures to identify assets no longer in use that could be disposed of or traded in on a newer asset? Is a detailed fixed asset ledger maintained by the organization? 4. What type of development software are you using? Is it computerized? B. Procurement Processes 1. Authorization of purchases: 2. Does the organization use purchase orders: Who approves requisitions? 10

11 When is the approval of the executive director or designee required? If purchase requisition forms are not used, how are purchases initiated and who approves purchases? How are the steps in the process documented? (signatures, memos, etc.) If purchases are to be funded by a restricted gift/grant, does the organization consider whether purchases meet the restrictions imposed by the donor or grantor? C. Cash Disbursements 1. Approval of vendor invoices: Who receives vendor invoices? (e.g., accounts payable department) Prior to making payments, are vendor invoices matched to a receiving report and to the purchase requisition forms? In the case of services, prior to making payment, is it verified that services have been satisfactorily performed? Who has the authority to approve vendor invoices for payment? 11

12 How are approvals documented? 2. Payment of approved invoices: Once invoices are approved, are payments forwarded directly to vendors? Who signs checks? When are checks required to have two signatures: Are signature plates kept in a secure location? Who has access to signature plates? Are blank checks kept in a secure location? Is there adequate segregation of duties? (Do persons having access to bank checks have the ability to print and/or sign checks and have access to signature plates? Do persons who print checks have the authority to sign checks? Is there a supervisory review performed before checks are distributed to vendors? Are monthly bank reconciliations performed by individuals not associated with the payment process? 12

13 3. Recoding disbursements transactions: If purchases are to be funded by restricted gifts/grants, how is this recorded? 4. Do you have a petty cash fund(s)? D. Payroll 1. Is there adequate segregation of duties? (Do persons having access to employee files also process payroll?) Are time sheets used? Are they adequate to record projects worked on? What controls are in place to ensure that employees are paid for time worked? What controls are in place to ensure that sick time and vacation time are adequately tracked? Does the employee record or is a member of management recording time? 13

14 2. Do you have a lot of hourly employees? 3. Do you use the work of consultants? How often? Do you issue contracts with consulting expectations? 4. What controls are in place to ensure that only authorized individuals receive compensation? 5. Does the organization use an outside payroll service? 6. How are human resource personnel issues/changes communicated to the payroll department? (See Item 2 of the Disbursement Process above for control identification around the actual preparation and distribution of payroll checks.) E. Government Contracts 1. How are budgets prepared for contracts? Who reviews before submission? 2. Is a master spreadsheet kept listing all contracts? 3. Who handles contract modifications? 14

15 Do program managers receive actual expense reports compared to budget? F. Budgeting Does the organization undertake a yearly budgeting process? If yes, who prepares budgets and how are they prepared? Who reviews and approves budgets? How often are budgets to actual results reviewed? With whom are the results shared? (governing board, management, program directors) Are modifications made throughout the year? G. Investments Does the organization have investments? If yes, specify a general description of the types of investments. Is there a formal investment policy? Is there an investment manager or trustee? Does the organization have an oversight committee? 15

16 H. Endowments Does the organization have an endowment fund? What types of restrictions apply? How is compliance monitored? I. Tax Reporting Does the organization have independent contractors? Does the organization have deferred compensation plans or pension plans? Does the organization have any activities that might be considered unrelated business income? J. Financial Reporting What types of reports are prepared? Who is provided with reports? What type of information is included in reports? 16

17 How is report information formatted? K. Staff Composition 1. How many staff members in your organization? 2. How many staff members in your fiscal department? 3. Do you have designated staff solely devoted to handle (please circle): Human resources Y N Development Y N Technology Y N Grants administration and compliance Y N If not, are these functions part of the fiscal department? Please explain. 4. How would you describe your fiscal office s turnover rate? q Very frequently (several times during the year) q Somewhat frequently (every 2 to 3 years) q Somewhat infrequently (every 5 years) q Hardly ever (every 6 to 10 years) 5. What accounting software package do you use? For how long? 17

18 18

19 19

20 Additional Fraud Resources Gerard M. Zack, Fraud and Abuse in Nonprofit Organizations: A Guide to Prevention and Detection (New York: John Wiley & Sons, Inc., 2003) Andrew S. Lang and Tammy S. Ricciardelle, Preventing Fraud: How to Safeguard Your Organization (BoardSource E-Book series, 2001) Edward J. McMillan, Policies and Procedures to Prevent Fraud and Embezzlement (New Jersey: John Wiley & Sons, Inc., 2006) Peggy M. Jackson, Nonprofit Risk Management & Contingency Planning (New Jersey: John Wiley & Sons, Inc., 2006) ECFA Knowledge Center ECFA.org Association of Certified Fraud Examiners International Fraud Awareness Week 20