Internal Control Questionnaire for Small Contractors

Yesterday we discussed a contractor's lack of robust internal controls that allowed an employee to embezzle $1.3 million over a four year period. If you missed that post, you can read it here. Every company needs internal controls but small companies sometimes cannot afford to have comprehensive systems to guard against fraud, waste, and abuse. But there are things even the smallest company can afford.

The following is an internal control/defalcation checklist adapted from a publication by the American Institute of Certified Public Accountants (AICPA) that independent independent accountants/auditors use to assess the adequacy of internal controls at companies of any size.

Use it to self-assess how your company measures up.

1. Segregation of duties
     a. Is the person who handles cash also responsible for recording cash?
     b. Does the person who pays or orders inventory also receive materials?
     c. Are two or fewer people responsible for the accounting function?
     d. Is only one person responsible for reviewing financial statements each month?
     e. Is your review of financial journals sporadic?

2. Bank reconciliations
     a. Do you reconcile the bank statement on a timely basis, at least once a month?
     b. Do you review any adjustments and verify reconciling items?
     c. Are reconciliations performed by one person and reviewed by another?
     d. Is the person who writes checks restricted from signatory authority?
     e. Do you review canceled checks and endorsements on a monthly basis?
     f. Do you compare payroll checks with your current employee records?
     g. Do you question funds transferred between bank accounts?
     h. Do you track the number of credit card bills you sign each month?

3. Supporting documentation
     a. Do you ever sign b lank checks?
     b. Do you ever sign checks without original supporting documentation?
     c. Have funds ever been transferred between accounts without review or verification?
     d. Do you ever sign checks for new business vendors without knowing or verifying their name and association with your company?

4. Employees - know your employees and be aware of changes in their behavior
     a. Are any employees extremely possessive of their work records and reluctant to share their tasks?
     b. Are any employees apprehensive about taking a vacation and time off, and are also the first one in the office and the last one out?
     c. Have you notice a substantial change in the lifestyle of any employees?
     d. Do any of your employees have a possible substance abuse problem?
     e. Are any of your employees living beyond their means?
     f. Have you ever hired an employee without checking references?
     g. Do you permit accounting personnel to work longer than a year without taking a vacation?
     h. Do you have any accounting staff who has not been bonded?

5. Safeguard assets
     a. Are blank checks and signature stamps locked up?
     b. Do you restrictively endorse all checks?
     c. Do you deposit all cash and checks daily?
     d. Do you maintain a list of office furniture, equipment, and vehicles?
     e. Do you back up all computer files on a regular basis and store the backup in a remote location?
     f. Do you have password restrictions for your systems?
     g. Do you maintain adequate insurance coverage n all assets including business interruption insurance?

How does your company compare? Remember, "trust" is not an internal control.