Conducting an Internal Audit
The Institute of Internal Auditors defines an internal audit as "... an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes."
Put differently, an internal audit reviews and evaluates current processes, looks for areas of risk, and makes sure financial and operational information is accurate and reliable. An internal audit helps make sure your assets are safe and your business is free from fraud or other illegal activity.
An internal audit can be very thorough or it can just focus on making sure that your business has not fallen victim to fraud. If you are interested in conducting the latter type of audit, focus on these key areas:
- Assets. Pull out your current list of assets and review it. Verify all assets are accounted for (and hopefully in use). If items are missing, find out why. If items are no longer in use, see if they can be returned to use, sold, or written off the books.
- Revenue. This step is especially important if you run a retail or multi-transaction business, but it also applies to any type of business. At random, pull three or four days' worth of sales receipts. Match those receipts to bank deposits made. Ensure that what came into your business stayed in your business.
- Bank accounts. Pull your last three bank statements. Match deposit slips with deposits. Match canceled checks and other debits with account debits. Look for missing or inaccurately recorded transactions. And make sure your processes are being followed. For example, you may require one employee to prepare and make deposits while another employee is responsible for reconciling sales and bank statements. Make sure any internal control processes are being followed.
- Accounting. Embezzling is easier when your bookkeeping is sloppy or, worse, unsupervised. While you don't need to be an accountant, you do need to understand the basics of your accounting system. Ask your accountant for guidance or take a class. Where bookkeeping is concerned, the phrase "trust but verify" definitely applies.
- Purchase orders and invoices. Purchase order totals should match the corresponding invoice for the goods and services you agree to purchase. If you authorize a purchase order for $1,500 and when the invoice is paid the total is $2,000, what caused the increase in spending? Did you authorize that increase? Did you receive the goods or services you actually paid for? Especially check long-term or recurring spending; in some cases you may no longer need what you have grown accustomed to paying for.
- Inventory. Periodically check inventory levels, matching what is on hand with what should be on hand. Also, don't forget incoming items; set up a process where two people are responsible for receiving and storing incoming inventory. One easy way to prevent inventory theft is to post check-off sheets showing the inventory on hand, what is removed from inventory, and by whom. An employee might be more tempted to steal items if they feel no one will notice right away; posting current inventory totals makes theft less tempting.
- Employees. If you have hourly employees, match time cards or attendance data with wages paid. Especially check on overtime or bonus pay; make sure that expense was not only authorized but that the work did in fact take place. Also verify that wage levels have not changed without your - or an authorized party's - permission. Finally, make sure no "phantom" employees exist; while relatively rare, in larger companies it's possible for a fictitious person to be on the payroll (especially if you use direct deposit) with another employee pocketing the money. An easy way to catch phantom employees is simply to occasionally hand out the paychecks yourself; it's hard to give a paycheck or pay stub to an employee who doesn't exist.
Adding External Audits
Take the process a step farther and bring in an outside auditor. The process doesn't have to be expensive or too time-consuming. Have an accounting professional audit your books and your basic financial processes. Ask for what some people call a "fraud audit" instead of a general audit; let the auditor know you specifically want to ensure that no illegal or fraudulent activity is taking place. A fraud audit is much less expensive and takes a lot less time than a general, comprehensive audit.
Perform your external audits on an annual but irregular basis; that way no one will know exactly when the auditor might show up -- and won't be able to take steps to cover up fraudulent activity. Employees may be tempted to steal from your company if they feel no one is looking - or will look. An external audit could be the ounce of prevention that creates a pound of cure.
Even if you do employ an external auditor, you should still conduct internal audits. Not only will you avoid fraudulent activity, but you'll also gain a better understanding of how your business runs.