Internal control examples
The Board of Trustees delegates authority through the Chief Executive for the day-to-day running of the organisation. In a large and busy organisation it is not practical to expect one person to make all the decisions and authorise all transactions. The Chief Executive will, therefore, further delegate authority to members of the staff team to relieve the load and to ensure smooth operation during absences of key staff.
Delegated Authority Document
Every organisation should decide in advance who should do what in finance procedures. It is good practice to record what has been decided in a Delegated Authority document; its purpose is to clarify who has the authority to make decisions, commit expenditure and sign legal undertakings on behalf of the organisation so that there is no confusion about responsibility.
The Delegated Authority Document should include instructions for such duties as:
- Placing and authorising orders for goods and services
- Signing cheques
- Authorising staff expenses
- Handling incoming cash and cheques
- Access to the safe and petty cash
- Checking and authorising accounting records
- Signing legal undertakings
The Delegated Authority document must be approved by the governing body and should be reviewed every year to ensure it is still appropriate to current needs. It should also outline deputising arrangements to cover for absence of key personnel. A breach of delegated authority is a serious matter and should be dealt with accordingly.
A sample delegated authority document is found in the Appendix of the Course Handbook.
- No one should authorise any transaction from which they will personally benefit. This lays the individual open to claims of impropriety and calls into question the integrity of the organisation.
- Sub-ordinates must not authorise payments to managers – they must be passed to someone who is more senior in the management structure.
Any limits or conditions that apply to delegated authority must be clearly defined. For example, a person may be authorised to commit expenditure up to a specified amount or within certain categories of expenditure or within budget.
The closing balance on the Bank book should be reconciled to the closing balance on the bank statement at each month end. This very powerful control enables the organisation to identify omissions and errors in its own records, as well as being the only way to spot cheque fraud, bank errors and even bank fraud.
A bank reconciliation statement needs to be prepared for every bank account every month, then reviewed by and signed by another responsible person such as the manager or Treasurer.
See an example bank reconciliation format.
Each cheque should be signed by two signatories. Signatories should be:
- Patient and thorough enough to review documents properly, and
- Available so that payments are not held up.
It is advisable to have 3 or 4 possible signatories known to the bank, ie some spare in case the main signatories are not available. It is common to have ‘A list’ and ‘B list’ signatories, where the A list are principle signatories who much sign first (usually staff), and the B list may only sign second (often Board members).
Signatories should be regularly reviewed and the list updated when people leave the organisation.
NEVER ask signatories to sign blank cheques for future use as this defeats the whole purpose of having more than one signatory.
Always close bank accounts that are not needed any more. Dormant accounts make a perfect breeding ground for fraud.
1. Keep cash transactions to an absolute minimum
Avoid all the risks associated with cash by making as many payments as possible by cheque or transfer. Cash should only be used to make payments when all other methods are not possible.
2. Use an ‘imprest’ system
This involves having a fixed float (say $100). As you spend (say $70) the float reduces (to $30). When you top up the petty cash you withdraw $70 from the bank to take the float back to $100. When the bank signatories sign to withdraw the $70, they can also check the receipts to support the $70 just spent.
This system is good because the risk is limited to the value of the float. Any problems with expenditure get spotted very quickly, because all the receipts are reviewed at each top up.
More detail on how to operate an imprest system is found in Introduction to Basic Bookkeeping.
3. Restrict access to petty cash and the safe
Keys to the petty cash box and the safe should be given only to authorised individuals. This should be recorded in the organisation’s Delegated Authority document. It is good to have two keys (eg to the draw and the cashbook) with one copy of each key given to two responsible people as back up.
4. Cash count reconciliations
The petty cash should be counted and reconciled to the cashbook balance at least weekly. If the imprest system is in use, this is very easy as it is simply a matter of counting up all the payments made since the last reimbursement and counting the cash in the tin. The two totals together make up the total float. If a discrepancy is found, it should be noted in the petty cash book as either an ‘cash count loss’ or a ‘cash count gain’ and allocated to an appropriate category. Discrepancies must be reported to a manager. Usually the cashier should be held responsible for cash shortages.
See an example cash count reconciation format.
5. Keep money coming in separate from money going out
It is better to deposit cash received intact (ie untouched) straight to the bank, rather than spending it directly. This allows bank signatories to exercise their authorisation control over withdrawal of cash. If you are operating an imprest system, putting cash receipts into the cash tin will confuse the system.
6. Always give receipts for money received
Receipts should be written in ink, and a duplicate copy made (eg with carbon paper). Ideally receipts should be printed and pre-numbered, and stamped and signed by the person issuing the receipt. Unused receipt books should be kept under lock and key and carefully controlled using a register.
7. Always obtain receipts for money paid out
Sometimes this may not be possible. For example, when purchasing from a market; in this case the cost of each transaction should be noted down straight away so that the amounts are not forgotten and these can then be transferred to a petty cash slip and authorised by a line manager. Remember – no receipt means there is no proof that the purchase was made.
8. Pay surplus cash into the bank
Having cash lying around in the office is a temptation to a thief and the money would be better managed if it were earning interest in a bank account. A casual approach to cash on the premises might also lead to people wanting to ‘borrow’ from it – many a sorry tale of fraud has started in this way. Every attempt should be made to pay cash into the bank on a daily basis or, at the very least, within 3 days of receipt.
9. Have a safe
Having a safe – or a safe place – to keep cash, cheques books, legal documents, etc. is an important consideration. A proper safe is worthwhile considering especially if your organisation has to keep large sums of money on the premises overnight. Safes are however, expensive and if resources are tight then it may be better to improve on banking procedures.
Fixed assets (eg land, buildings, vehicles, machinery and office equipment) are often not properly tracked, and the risks of assets being stolen and often high.
The controls over fixed assets include: maintaining an assets register, verifying the existence and condition of assets periodically, and developing policies for authorisation of asset disposal. In a large organisation, it may also be necessary to track movement of assets between departments (with an asset transfer form), and assign responsibility for assets to department heads.
The Assets Register
An Assets Register should be established with an entry or record sheet for each asset. Each asset should be given a unique reference number for identification purposes. The register will contain information about where and when the item was purchased; how much it cost; how much it is insured for; repair history; reference number, serial numbers and details of guarantees or warranties. It may also contain information on depreciation, if that is relevant.
The record sheet should also state where the item is held and who is responsible for its maintenance and security. The Assets Register should be checked by a senior manager or committee member every quarter and any discrepancies reported and appropriate action taken.
See an example fixed asset register.
Regular maintenance (eg of buildings and equipment) helps to improve safety and prolongs the life the assets, as well as preserving their value.
- Making this a reality usually requires a pro-active maintenance policy.
- Buildings may require a professional planned maintenance contract for which a realistic budget must be provided.
- Office equipment such as photocopiers and electrical equipment should also receive regular services by qualified technicians.
Insuring your assets against theft or damage is an easy way to transfer the risk of asset loss. Take special care to insure:
- Motor vehicles
- Cash (if you have to transport large amounts of it)
- Buildings against fire, contents against theft
- Any asset of high value that is easy to steal
- Any asset without which your organisation would struggle to operate
Beware that if you purchase new assets during the year, they will not authomatically be added to your insurance policy unless you notify your insurer.
Have a way of reminding yourself when various policies are up for renewal so that non are allowed to lapse by accident.
Every organisation that owns vehicles should have a vehicle policy. This will set down the policy on a range of issues such as:
- Purchasing, replacement and disposal
- Maintenance and repair
- Private use of vehicles by staff
- What to do when accidents happen
- Driver qualifications and training
- Carrying of passengers
The costs of repair and replacement must be also adequately reflected in the budget process.
For each vehicle there should be a log of journeys so that the running costs per kilometer can be assessed and private use closely monitored.
Purchasing fuel with cash is a risky business, and it may be safer to set up an account with a reputable fuel company and pay monthly by cheque instead.
If your NGO maintains stocks (eg of drugs, food etc), it is very important that they are properly tracked. A stock record should be maintained for each type of stock showing amounts in, out and balance, with each entry referenced to a supporting document giving detail about the receipt or issue of goods.
Stock counts should be carried out periodically (say monthly) and reconciled to the expected balances shown in the stock records. The stock counts should not be done by the same person who has custody of the stock (segregation of duties). Stock discrepancies need to be investigated promptly as they could be an indication of stock being stolen.
A system needs to be put in place to ensure that older items are issued first, to reduce the risk of obsolescence or expiry. And a system also needs to be put into place to ensure that new supplies are ordered before stock levels run too low.
Payroll spreadsheets are famous for containing errors (especially tax calculations) and even fraud in the form of ‘ghost employees’. Payrolls should be checked and authorised by someone other than the preparer. For large payrolls it can be useful to provide a summary of changes from last month’s payroll total to this month’s total, which focuses the reviewer’s attention on joiners, leavers and salary changes.
Non payment of taxes or social security contributions is a common problem, that may result in penalties and fines.