Importance of Culture on Internal Controls by Daniel LeBlanc, CPA

The Importance of Culture on Internal Controls Daniel LeBlanc, CPA, MACC daniel@whiteolivecpa.com 615-582-1880

Intro 12+ Years of experience in Public and/or Corporate Accounting 5+ Years of experience in Entrepreneurship Successfully exited a start up in 2021; Currently in practice as a CPA firm; Over 17 years of overall experience in corporate accounting role or small business role

What Are Internal Controls? Internal controls are the mechanisms, rules, and procedures implemented by a company to ensure the integrity of financial and accounting information, promote accountability, and prevent fraud. Internal controls aid companies in complying with laws and regulations, and preventing employees from stealing assets or committing fraud. They can also help improve operational efficiency by improving the accuracy and timeliness of financial reporting. Internal audits play a critical role in a company s internal controls and corporate governance. The Sarbanes-Oxley Act of 2002 made managers legally responsible for the accuracy of their companies' financial statements.

Components of Internal Controls Control Environment Risk Assessment Monitor Information/Communication Control Activities Compliance with Laws and Regulations Separation of Duties Physical Controls

Control Environment A control environment establishes for all employees the importance of integrity and a commitment to revealing and rooting out improprieties, including fraud A board of directors and management create this environment and lead by example. Management must put into place the internal systems and personnel to facilitate the goals of internal controls.

Risk Assessment A company must regularly assess and identify the potential for, or existence of, risk or loss. Based on the findings of such assessments, added focus and levels of control might be implemented to ensure the containment of risk or to watch for risk in related areas.

Monitor A company must monitor its system of internal controls for ongoing viability. Doing so can ensure, whether through system updates, adding employees, or necessary employee training, the continued ability of internal controls to function as needed.

Information/Communication Solid information and consistent communication are important on two fronts. Clarity of purpose and roles can set the stage for successful internal controls. Facilitating the understanding of and commitment to steps to take can help employees do their job most effectively.

Compliance with laws and regulations An organization's financial activities must adhere to all relevant laws, regulations, and standards. This involves keeping up-to-date with changes in financial regulations and implementing measures to ensure compliance.

Separation of Duties Distributing responsibilities among different people reduces the risk of error or inappropriate actions. This includes separating authorization, custody, and record-keeping roles to prevent fraud and errors.

Physical Controls A business must implement security measures to protect its assets, including cash, inventory, and equipment. This could involve secure storage facilities, access controls, and surveillance systems.

Question 1 What is the most impactful component of internal controls? A) Separation of duties B) Compliance with Laws and regulations C) Control Environment D) Physical Controls

Answer: C) Control Environment

Preventative vs Detective Controls Internal controls are typically comprised of control activities such as authorization, documentation, reconciliation, security, and the separation of duties. They are broadly divided into preventative and detective activities.

Preventative Controls Preventative control activities aim to deter errors or fraud from happening in the first place. They include thorough documentation and authorization practices. Separation of duties, a key part of this process, ensures that no single individual is in a position to authorize, record, and be in the custody of a financial transaction and the resulting asset. Authorization of invoices and verification of expenses are internal controls. Limiting physical access to equipment, inventory, cash, and other assets.

Detective Controls Backup procedures designed to catch items or events the first line of defense has missed. A reconciliation is a good example of detective controls Corrective action is taken upon finding material differences. Other detective controls include external audits from accounting firms and internal audits of assets such as inventory.

Limitations of Internal Controls Internal controls can only provide reasonable assurance that a company's financial information is correct. The effectiveness of internal controls can be limited by human judgement For example, a business may give high-level personnel the ability to override internal controls for operational efficiency reasons Internal controls can be circumvented through collusion, where employees whose work activities are normally separated by internal controls, work together in secret to conceal fraud or other misconduct.

Overall Strong policies and procedures are necessary to have internal controls to protect and detect financial statement inaccuracies, prevent fraud, etc. However, policies are procedures are only as strong as those who are working to ensure they are being done and met. Therefore a company culture that values internal controls is crucial to being successful

Question 2 Performing a bank reconciliation is an example of what type of internal control? A) Detective Control B) Preventative Control C) Mitigating Control D) Operational Control

Answer A) Detective Control

Company Culture The number one factor in the effectiveness of internal controls is the control environment The atmosphere in which people conduct their activities and carry out their control responsibilities The control environment is: include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.

Company Culture Embed internal controls into the company s culture: The control policies need to be integrated into the organization s culture and used as part of everyday operations Leadership Style The style of leadership can affect the relationship between internal controls, corporate governance, and employee engagement. Top Management Team The political leanings of a company s top management team can affect the implementation of an effective internal control system. Organizational Culture Can be more effective way to control employee behavior than rules and regulations

What is the control environment? A) The atmosphere in which people conduct their activities and carry out their control responsibilities B) The buildings in which the company operates C) The political atmosphere in which the company operates. D) The physical and non-physical surroundings that support life on Earth

Mission Statement Having a Strong Mission Statement Defines a company s purpose, values, and objectives Explains why the company exists, what it does, and how it will achieve its goals Focus on Value: Consider what the company provides to its customers and employees Be Inspiring: Consider why people should want to work for the company. Make it plausible: Ensure the statement sounds reasonable. Be specific: Tie the statement back to the business. Make it original: Ensure the statement is unique to the company. Make it foundational: Try to avoid changing the statement too often.

Real Life Story

Conclusion The best and most effective way to ensure financial success across an organization is to instill a culture that values internal controls. The company s mission statement and core values must be integrated into the policies and procedures surrounding internal controls Values and policies must be communicated regularly. Evaluate personnel to determine if they are a good fit for the company culture.