Using Technology To Support & Strengthen Internal Controls
Whether you run a for-profit business or a nonprofit organization, you need strong internal controls in place to protect your organization’s assets, data, employees and customers. Internal controls are the policies and procedures organizations use to mitigate issues that can cause loss or harm, whether due to human error, fraud, physical damage, procedural inefficiency, or legal non-compliance.
Internal controls can be preventive, detective, or corrective. Preventive controls aim to avoid issues and include things like proper segregation of duties and data encryption. Detective controls are designed to uncover issues that have already occurred and include things like internal audits and security cameras. Corrective controls are designed to fix the issues discovered by detective controls.
Because they are designed to stay ahead of issues, preventive controls are ideal. There are multiple ways that technology can help business owners and nonprofit leaders as they shift their risk-management approach from a reactive stance to a proactive one.
Automating Manual Processes
Automation reduces the risk of fraud and human error while improving efficiency. It saves you time and money in several ways. Eliminating manual tasks helps you avoid data entry errors, facilitate efficient account reconciliation and reporting, detect suspicious activity, and prevent fraud.
You may find opportunities to automate manual processes in some of the programs you already use. For example, if you use QuickBooks® Online (QBO), you can sync bank and credit card accounts to the software, so all of your transactions sync automatically to your QBO check register. Programs like Freshbooks® also automate reconciliation by allowing you to approve, change, and import transactions directly from a synched bank account.
Supporting Compliance
Technology can help businesses and nonprofits comply with laws and regulations, such as wage and hour laws. For example, time tracking and attendance software can be a valuable tool. When it is integrated with payroll and scheduling, you have the opportunity to add controls to cross-check pay rates, ensure accurate deductions, track attendance and paid time off, comply with federal and state laws related to overtime pay, and ensure employees and independent contractors are paid according to their status.
Technology can also help you meet record retention requirements without the hassles of housing and maintaining physical paperwork. For example, if you use QBO, you can scan and attach documents, such as checks, invoices, or money orders, to each transaction. You can also run QBO’s Audit Trail Report to view a detailed transaction history and supporting documentation.
Adapting for Remote Access
The remote workforce has changed how organizations operate; the same is true for their internal controls. For example, if your process for financial reports is to print them out, have them hand-initialed, and file them away in the office, this approach is no longer tenable if employees are working remotely. A cloud-based document management program would reduce the paperwork you store, improve processing time and efficiency, and facilitate remote access to company documents.
One of the most critical preventive controls in document management is updating and monitoring user access within the software. For example, in this case, only those involved in the financial reporting process should have access to financial reports. As for approving and initialing the reports, programs like Adobe Acrobat Sign® allow users to sign off on and lock a pdf simultaneously.
Preventing & Detecting Errors & Fraud
Controlling data access is key here. For example, are there termed employees who still have access to your organization’s network and applications? HR personnel can use technology to compare termination data with network and application user listings. When access privileges need to be revoked or changed, HR receives a notification in real-time, which helps you keep tighter control over sensitive data.
Business owners and nonprofit leaders should also take measures to restrict changes to transactions after an accounting period has closed. For example, in QBO, you can close a prior period, restricting access to all users except the administrator with the correct password. Technology also helps highlight the root causes of issues through detective controls. For example, The Audit Trail Report in QBO provides information by transaction, including any user that made changes and when.
As demonstrated in the examples above, many of your greatest assets in strengthening internal controls may lie within the programs you already use or are available as add-ons or integrations. Ultimately, the technology that best supports your internal controls depends on your organization’s specific needs and circumstances, and that’s one of the ways L&H can help!
Contact Livingston & Haynes
L&H’s accounting and attest team provides internal audit services that give business owners and nonprofit leaders a chance to revise oversights and mistakes before they are discovered in an external audit. I want to help you maximize the use of technology and strengthen your internal controls. To discuss your internal control strategy, contact me today.
Wendi Haynes, CPA, serves as Livingston & Haynes’ Managing Partner and has been with the firm for over 30 years. Wendi has extensive experience providing accounting, auditing, tax, and advisory services for small businesses, nonprofit organizations, and employee benefit plans.