MicroCred Internal Control Basics. Assessing the internal control structure 9/29/2014. Goals of the internal control structure

Size: px

Start display at page:

Download "MicroCred Internal Control Basics. Assessing the internal control structure 9/29/2014. Goals of the internal control structure"

Oswin Houston
5 years ago
Views:

1 MicroCred Internal Control Basics Howard Brady, Facilitator 1 Assessing the internal control structure 2 Goals of the internal control structure To provide reliable data To safeguard assets and records To promote operational efficiency To encourage adherence to prescribed policies To comply with country legislation / laws (FCPA 1977, SOX, etc.) 3 1

2 The goal of IC is to reduce risk to an acceptable level Are all material risks known? Are measures in place to mitigate risks to an acceptable level? Are the board and management convinced that the internal control structure is safe and effective? Do we have a mechanism to constantly improve out internal control structure 4 Elements of the Internal control structure Management Philosophy and operating style Organizational Structure Audit Committee Methods to communicate the assignment of authority and responsibility Management Control Methods Internal audit function Personnel policies and procedures External influences 5 Components of an IC Structure Internal Environment Risk Assessment Objective setting (Why have an IC Structure?) Event identification (What are the risks? How are they managed?) Risk assessment (High, medium, low or absolute values) Risk response (Which risks deserve controls) Control Activities Manual vs. automated Information and Communication (what to tell whom) Monitoring (additional risks? IC structure working as planned) 6 2

3 Control procedures risk focus Establishment of Responsibility Adequate segregation of duties Adequate documents and records Physical, mechanical and electronic controls over assets and records Independent checks on performance Other controls (insurance) 7 Major components of MF Risk Institutional Risk Social Mission Commerical Mission Dependency Operational Risk Credit Fraud Security 8 Major Components of MF Risk Financial Management Risks Asset / Liability Management Inefficiency System integrity External Risks Regulatory Competition Demographic Physical Environment Macroeconomic 9 3

4 Major transaction cycles Loan Disbursement Loan Collection Cash payment for expenses / procurement Payment of salaries and benefits 10 Segregation of Duties 11 Separation of the custody of assets from accounting DO T Cashier receives cash and updates both cash receipt and loan registers Hiring manager disburses payroll 12 4

5 Separation of authorization from custody of related assets DO T Branch manager approves loan and disburses the loan 13 Separation of operational responsibility from record keeping responsibility DO T Loan officer updates registers that determine incentive pay 14 Best Practice (cost prohibitive) Loan officers only lend (no cash handling or systems responsibility) Branch managers only approve loans (no lending responsibility or cash handling responsibility) Cashiers only receive cash and keep cash receipt books (others do posting to loan registers) 15 5

6 Mitigating controls Tight systems to record cash-out and cash-in Very effective manual systems exist ASA Bangladesh Transparent record keeping Preventative fraud controls 16 Process Maps as a tool for Internal Control / Internal Audit and Efficiency 17 Benefits of Process maps Process mapping helped Pro Mujer icaragua (PM) and MI-BOSPO (MI-B) to achieve the following results: Increased loan officer caseload for group lending products from 493 to 538 (PM) and from 413 to 457 (MI-B); Reduced the number of days to disburse new group loans from 7 to 4 days (PM) and from 16 to 9 days (MI-B); Lowered operating cost ratio from 42% to 35% (PM); Lowered cost per loan disbursed from USD 22 to USD 18 (PM) and from USD 122 to USD 106 (MI-B). Maps risk areas Highlights segregation of duties issues 18 6

7 Internal Control Findings Example MFI Current State Savings Deposit Process Map Head Office CSO Client Accountant Cashier Auditor Creates Marketing Strategy Implements Marketing Strategy Do I Save? Savings Application & Passbook DS = Cash? DS = Passbook? Accu rate? Deposit Slip - Prepared By Receives Cash, Records Passbook Deposit Slip - Checked By Deposit Slip - Deposited By Receives ellow DS, Posts to Card Deposit Slip - Collected By Audits Blue DS Sequence End Receives Passbook, White DS Cash Receipts Journal Entry Receives Passbook, Deposit Slip Separates Deposit Slip Errors or Irregularities? Do I Save? Posts General Ledger End of Day Cash Proof Audit Investigation 19 Audit Basics 20 Frequently Asked Questions Why is an Internal Auditor important? What can be done prior to having an internal auditor? When does the MFI need an internal auditor? When does the MFI need the next internal auditor? Who makes a good internal auditor? How to train the audit staff? How much are you spending on internal audit? Who does the auditor report to? How to classify risk in the audit? How much time should be spent in the field vs. head office? How much time should be spent in portfolio auditing? 21 7

8 Why is an Internal Auditor important? Legal / regulatory statutes demand an internal auditor As part of management s responsibility for internal controls, the internal auditor tests compliance with those internal controls. As opposed to the external auditor, s/he is not as focused on balances per se, but on systems that create the conditions to generate correct balances. Important fraud deterrent. eeds to be embraced by senior management. Sr. Management should esteem a clean audit report at the branch level and find a way to reward the branch, even if it s just in acknowledgement that they scored acceptable on their internal audit report. All branches should strive for this. Branch managers should have access to the internal auditor if s/he feels that something is amiss. The internal auditor can play an important role in making sure the MFI is efficient and effective. A certain part of their role is to look at the big picture of how operations are accomplished and help make operations run better. An simple system is easier to maintain than a complex system Enough slack time should be available in the auditor s agenda to work through special cases and problems. 22 What can be done prior to having an official internal auditor? Operations manager (and other head office visitors) can perform audits during branch visits. It might be that reconciling petty cash by every visitor, or making sure that loan documents are filed consecutively, or pulling five loan files to make sure that all records are complete is effective. Document results and share with other members of senior staff. Increase frequency of visits if it appears that policies and procedures are not being followed. Likelihood of a subordinate checking the work of his/her superior is unlikely and not a good control In fact anyone who is independent of the person doing the work can be part of the internal control solution. 23 When does the MFI need an internal auditor? 5,000 clients A remote branch More than one regional office 24 8

9 When does the MFI need the next internal auditor? Say 50% of time spent at branches. Say 1 2-week audit each year or 2 1-week audits each year branches could be audited in a year, plus the head office. Recommendation, 1 auditor for every branches or auditable units. BRAC strives to audit its units twice per year. 50 Auditors covered 1000 branches, or 20 per auditor. (2003 data) If audit only takes 2 days due to population density, certainly the auditor can have more coverage Follow the same general supervision guidelines: 1 supervisor to 4-8 subordinates 25 Who makes a good internal auditor? Operational staff, such as branch managers with 2-4 years of experience should know the control environment fairly well and might be a good candidate for the job. Having a head office job with institution wide responsibility can be a draw. External auditors can be a good source,or a bad source. They might want to audit balances and not transactions, which is incorrect. Make sure that they have a good feeling for transaction based auditing before going this route. For a period of time, internal audit could be outsourced to another CPA firm (the current firm might not want the work is it could compromise their independence for the annual audit) 26 How to train the audit staff? Consider the internal controls course at Boulder. It s a bit expensive, but might be worth sending the appropriate person for this training. Ask your external auditors about training. They might have some institutional resources available. Microfinance Centre for CEE and IS - microfinance@mfc.org.pl Self-directed learning / reading and sufficient sharpening the saw time should also be encouraged 27 9

10 How much are you spending on internal audit? Annual cost of internal auditor(s) personnel cost Annual cost of internal audit travel, per-diem, car, etc. Loan portfolio at 31 December 2013 Total expenses for the year ended 31 December 2013 (or last fiscal year) 28 Who does the auditor report to? Operationally, executive director Directly and clearly to the audit committee which reports to the board of directors. It needs to be clear that not even the executive director is above suspicion. Having the ED supervise or check-in from time to time on the work habits of the internal auditor (does s/he show up to work each day?) keeps the IA honest in daily activities. There needs to be a feedback loop that makes sure that operations folks are notified of staff not following appropriate procedure. If there are not consequences for willful disregard of internal controls, the controls are not effective, which increases overall risk. 29 How to classify risk in the audit? An error in the MIS calculation of interest is more troubling than a clerical error in adding petty cash slips An error in the design of the internal control system which could allow savings to be mishandled is more troubling than not consolidating all branches portfolio to the head office every day. Overall rule of thumb: systematic issues are more troubling than isolated cases. Look to the dollar volume of a potential error

11 How much time in the field vs. head office? 50 60% of the time in the field, rest in the office. Office time can be used to: Select samples Test MIS and accounting system accuracy Test payroll systems Test fixed asset purchasing systems Test treasury systems (often the chief financial officer has unlimited control over wire transfers in and out!) Inform management of findings Opine on documentation and processes Write some reports (although more effective to be written at the branches) 31 Branch audits should consist mainly (60-70%) on portfolio testing. Other tests include: Petty cash Existence of fixed assets Proper use of computers and transportation resources Compliance with board and management mandate. As part of the loan file testing, auditors may want to test if the client fit the definition of poverty established by the institution

Ten Payment Fraud Protections

Ten Payment Fraud Protections 1. Payee Positive Pay a. Provided by banks b. Banks match check serial numbers and dollar amounts against a company provided list of checks issued and only pays those checks