Who Should Be Responsible for Internal Controls?

What kind of accounting controls do you have in place right now?

If you are not sure, or are too embarrassed to answer, chances are you have some work to do.
​
Internal controls protect your business from not only fraud but also the kinds of financial errors and reporting mistakes that can negatively affect cash flow management, dissuade investors, and hinder long-term business growth. 

​Internal controls are the financial policies and procedures used to:

• Mitigate risk
• Prevent fraud and theft
• Proactively recognize financial challenges
• Reduce waste
• Increase operational efficiency
• Improve reporting
• Measure business performance
• Ensure compliance

And while accounting controls are incredibly important at every level of the business, they are also not the most glamorous topic to talk about. As a result, many small businesses deprioritize them in favor of more attractive and pressing topics like growth planning and hiring, assuming they can revisit the idea of implementing internal controls when they are larger. However, utilizing accounting controls is not just the job of big corporations. Companies of all sizes need internal controls to hold onto their value and establish trust among investors and other key stakeholders.

Every business owner must understand which types of internal controls are the most important to utilize, who can implement them, and who should oversee them.

Which Types of Internal Controls are Essential?
At companies where employees are resistant to embrace internal controls or management does not provide the resources to implement them properly, there is a temptation to do the bare minimum. Typically, this will involve things like locking up cash and requiring unique usernames and passwords to access information digitally. However, this “just checking the box” approach does little, if anything, to secure a company and may even harm it more by providing a false sense of security.

As fraud schemes get more sophisticated more must be done to protect your company from financial predators. Additionally, during times of economic uncertainty or financial downturns, profitability becomes even more important.

There are 8 types of essential internal control accounting systems that every business should have:

1. Establishing a Separation of Duties
2. Setting Access Controls (Physical and Digital)
3. Requiring Approvals
4. Conducting Audits
5. Creating Financial Templates
6. Using Trial Balances
7. Reconciling Accounts
8. Backing Up Data

Remember, while internal controls have accounting roots, they often touch other areas of a business as well, like finance, IT, and HR at all tiers from entry-level employees to executive management.
 
Who Can Implement Internal Controls?
We get this question a lot: “Who should we hire to create internal controls for us?”

Companies looking to establish internal controls may assume they need to hire an experienced accountant to fill this role. This sounds logical – after all, they are accounting controls, right?

That is true; however, this presumption overlooks two key facts:

1. You do not necessarily need to hire someone internally to accomplish this objective.
2. Ownership over internal controls should not solely be the responsibility of your accountant.

When evaluating who is the best qualified to create new accounting controls at your company, shrewd business owners and CEOs often outsource controls-related activities to consulting accountants or fractional controllers. But whether you plan on hiring in-house or outsourcing, internal controls should never just fall under the purview of accounting.

Who is Responsible for Overseeing Internal Controls?
Your entire organization needs to be responsible for controls, at least to some degree, for them to be truly effective.

Like any other wide-reaching initiative, internal controls like separation of duties and access controls must be adopted across the entire organization. Remember, your policies and procedures are only as good as your employees let them be. Things like access levels do not mean much if employees decide to share passwords or keycards. Everyone must have a share of the responsibility to uphold controls.

But in terms of who will oversee the entirety of internal accounting controls, a CFO oversees both accounting and finance, which puts controls squarely in their court.

And if you don’t have a CFO? Companies without a CFO will need to look to their controller or accounting manager to spearhead these initiatives in conjunction with the owner, president, or CEO. This may be a temporary responsibility until a CFO can be hired, or it may be permanent depending on your staffing needs.

Either way, you should not wait to get internal controls implemented or appoint someone to oversee them. Trust us, no one has ever said, “You know, I really wish I hadn’t started mitigating risk for my company so early.” Internal controls are important from day one – you can never start too soon

​If you are overwhelmed by the prospect of implementing and maintaining your accounting controls, hire a consulting accountant to manage your internal controls for you. Outsourcing this role to an experienced third-party provider stateside ensures you will have someone with extensive experience and knowledge of US-based accounting regulations at the helm of your financial controls to safeguard your business.