Ask the Experts - December 2010
The question in this edition of “Ask the Experts” is answered by Jay Burstein, Engagement Manager at Accounting Management Solutions. Our experts hope to answer any questions you may have, whether related to current financial trends, new financial policies, or any other questions. If we select your question to answer in the next edition of the AMS Report, you will receive an American Express Gift Certificate. Click here to submit your question.
Question: Which situation is better: excellent internal control policies and procedures with no written policy and procedure manual, or a written policy and procedure manual with adequate controls?
Answer: This is an excellent, frequently posed question. While many organizations have made great strides implementing internal controls, it is actually less common to see up to date, fully documented policies and procedures alive and in action. There is not one simple answer for every organization, so here are a few key points to consider as you conduct this debate in your company:
- It takes a lot of time and effort to develop a P&P manual (even when you outsource the development) and, given limited resources, management will respond first to a call for controls from outside auditors and audit committees. This is not to say that P&P manuals are not important; they generally cover detailed processes (within which are internal controls) and serve other internal control purposes, such as an achievement of efficiencies, reductions in errors, and instructions for stand-in staff when an employee is absent.
- If you don’t have P&P, which areas need them? How will they be used? What will it cost to develop them and who will do the work? Not every area or activity will require P&P and if they are deemed necessary, consider different degrees of breadth and depth to stay focused on key processes. If the decision is to move ahead, plan the project, identify resources (including the potential of outsourcing the project) and provide adequate time to get the work done.
- If you need to develop or expand P&P, keep in mind that this is the right time to reassess and add and/orbolster controls; there are often efficiencies and synergies when combining P&P development with the design and implementation of controls.
- What are “excellent” internal controls and how do they differ from “adequate” controls? There is such a thing as too many or too stringent controls. These can bog down an operation and create unnecessary costs. Organizations should “right-size” controls given the size, complexity and resources of the business.
- The most important thing to consider is whether controls in place are properly designed and operating to mitigate or prevent risks to the organization, such as errors in financial statements, economic losses, poor quality, and strains on vendor and customer relations. Perform a risk assessment to identify the greatest risks. Where weakness is identified in a critical area, spend the time and energy to get workable controls in place.
It is difficult to provide a simple, single answer, as no two organizations or situations are the same. However, from a pragmatic point of view, this is what I would like to be positioned to say to my Audit Committee: “Management has reviewed internal controls for key, financially and operationally significant operations and has found that adequate controls are in place to prevent or detect material errors in financial statements, economic losses due to processing errors, shrinkage or theft (and any other relevant problems that the organization may specifically identify as critical). In addition to the defined and documented controls, written policies and procedures are in place only for activities where there is a cost / benefit for development and maintenance of the documentation.”