When I was in college, I had a course in internal controls taught by the professor my father had when he was in college. I don’t believe much has changed since my father learned about internal controls. So when a new book was recently published about internal controls, I wondered about its benefits or use.
Internal controls are about as old as accounting, which can be traced back to circa 3400 BCE when the Sumerians developed the first instance of writing to keep accounting records. Moving forward to 1494, when Luca Pacioli gave us debits and credits, he opened his book with the three things needed by anyone who wishes to carry on business carefully: capital, a good accountant and proper internal controls.
Now, let’s fast-forward to today. If we already know everything we need to know about internal controls, then how come there are more and more defalcations, embezzlements and white collar crimes? How come controls are still loose and deficiencies fill up a good portion of management letters? How come one of the biggest fears of clients and managers is employee theft?
Internal control questionnaires have become extremely complicated and are designed to uncover weaknesses, but they lack the element of corrective actions. It might seem obvious that discovering the weaknesses will lead to fixing them, but that doesn’t seem to do it since many parts of the management letter in this regard is SALY (same as last year). What is missing is the call to action, the implementation of the fixes and the accountability of those in charge.
Certainly it is not the auditor’s job, and this presents a great opportunity for smaller accounting firms.
I suggest small firms propose to clients, businesses and nonprofits that they be engaged to perform internal control reviews, which would include an overview of the system, identification of weaknesses, presentation of solutions, and then oversight and management of the implementation process. Alternatively, for larger organizations, they could use the auditor’s management letter as a start. I see the core of the problem to be the failure to implement suggested changes.
A great resource for this is a new book, Internal Controls Toolkit, by Christine Doxey (published by Wiley). This provides methodologies to attack and destroy internal control weaknesses with checklists, templates, tables, charts, modules, matrices, risk mitigation solutions and deterrence mechanisms. The book, which is organized by key business processes, provides a complete toolkit and is a valuable resource for accountants advising their clients. This book will make it easier to perform the reviews and write the reports.
Included in the book are the most current approaches, including controls for IT security, AI and digital platforms, storage and retrieval, environmental processes and customer services, none of which existed when I went to college. Further, there is added background information for accountants in small firms, as well as those in private accounting, regarding governmental clients, merger and acquisition activities, and SOX 404 initiatives that extend beyond internal controls.
This book is a welcome addition to my bookcase, and I recommend it for yours.
Do not hesitate to contact me at
Edward Mendlowitz, CPA, is partner at
